CVE-2026-71235 Details

A vulnerability exists in Magistrala's Rules Engine, specifically in the Go and Lua script execution features. Authenticated users can create rules that include embedded Go or Lua scripts, which are executed on the server side when Internet of Things (IoT) messages are received. The Go script engine, utilizing the Yaegi interpreter, exposes the entire Go standard library, including potentially harmful functions related to file and network operations. Although there is some regex-based validation to prevent certain risky actions, many dangerous functions remain fully accessible. Meanwhile, the Lua script engine lacks any input validation and preloads libraries that enable arbitrary database access, file input/output, server-side request forgery (SSRF) against internal microservices, and file traversal. This flaw allows an authenticated low-privileged user to read or write arbitrary files, access environment variables, interact with databases, and perform SSRF attacks.