CVE-2026-71235

Name of the Vulnerable Software and Affected Versions Magistrala (affected versions not specified)

Description The Rules Engine allows authenticated users to create rules containing embedded Go or Lua scripts that are executed server-side upon the arrival of IoT messages. The Go script engine, located in re/golang.go, utilizes the Yaegi interpreter and exposes the full Go standard library, including os and net/http. Validation is limited to a regex that blocks panic() calls and goroutines, leaving dangerous functions such as os.ReadFile(), os.WriteFile(), os.Remove(), and os.Environ() accessible. The Lua script engine, located in re/lua.go, lacks input validation and preloads libraries that enable arbitrary database access (db), file I/O (ioutil), Server-Side Request Forgery (SSRF) via an HTTP client, and path traversal (filepath). Consequently, an authenticated low-privileged user can perform arbitrary file read/write operations, leak environment variables, access the database, and execute SSRF attacks against internal microservices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the ability of low-privileged users to create or modify rules within the Rules Engine. Restrict access to the re/golang.go and re/lua.go components to prevent unauthorized script execution.