CVE-2026-71235: Magistrala Rules Engine RCE Vulnerability

CVE-2026-71235 Overview

CVE-2026-71235 is a code injection vulnerability [CWE-94] in Magistrala's Rules Engine. The Rules Engine allows authenticated users to create rules containing embedded Go or Lua scripts. These scripts execute server-side when IoT messages arrive. Both script engines expose dangerous runtime capabilities to low-privileged users. An authenticated attacker can read and write arbitrary files, leak environment variables, access internal databases, and perform Server-Side Request Forgery (SSRF) against internal microservices.

Critical Impact
Authenticated low-privileged users can achieve arbitrary file read/write, environment variable disclosure, database access, and SSRF against internal microservices through malicious Go or Lua scripts embedded in Rules Engine rules.

Affected Products

Magistrala IoT platform (Rules Engine component)
Magistrala re/golang.go Go script engine using the Yaegi interpreter
Magistrala re/lua.go Lua script engine

Discovery Timeline

2026-08-05 - CVE-2026-71235 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71235

Vulnerability Analysis

Magistrala's Rules Engine embeds two scripting runtimes that execute code on incoming IoT messages. The Go engine at re/golang.go runs scripts through the Yaegi interpreter and loads stdlib.Symbols, which exposes the full Go standard library. Validation is limited to a regex that blocks goroutines and panic() calls. Dangerous functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ remain fully accessible.

The Lua engine at re/lua.go performs no input validation. It preloads dangerous libraries including db for arbitrary database access, ioutil for file I/O, an HTTP client that enables SSRF, and filepath for path traversal. Any authenticated user with permission to create rules can weaponize these primitives.

Root Cause

The root cause is missing sandboxing of user-supplied scripts. Both engines trust authenticated tenants and expose host-level primitives directly to rule authors. The Go engine's regex-based deny list is insufficient because it does not restrict filesystem, environment, or network functions. The Lua engine ships with dangerous modules preloaded by default.

Attack Vector

An authenticated low-privileged user creates a rule containing a malicious Go or Lua script. When an IoT message triggers the rule, the script executes with the privileges of the Rules Engine process. The attacker can call os.ReadFile to exfiltrate secrets, os.Environ to enumerate credentials, the Lua db module to query backend databases, or the HTTP client to reach internal-only microservices. The vulnerability mechanism is documented in the Magistrala GitHub repository.

Detection Methods for CVE-2026-71235

Indicators of Compromise

Rules containing references to os.ReadFile, os.WriteFile, os.Remove, os.Environ, or net/http in Go script bodies
Lua rule scripts invoking db, ioutil, filepath, or HTTP client modules
Outbound HTTP requests from the Rules Engine process to internal service addresses or cloud metadata endpoints
Unexpected filesystem access by the Rules Engine to paths outside its working directory

Detection Strategies

Audit all rules stored in the Rules Engine for embedded scripts and inspect script bodies for filesystem, network, and database primitives
Monitor process-level syscalls from the Rules Engine for open, read, write, and connect calls to unexpected targets
Log and review rule creation and update events, correlating them with the authenticated user identity

Monitoring Recommendations

Alert on network egress from the Rules Engine container to internal microservice IP ranges or 169.254.169.254
Track environment variable reads and file access outside the expected script working paths
Baseline normal rule content and alert on new rules containing sensitive API surface strings

How to Mitigate CVE-2026-71235

Immediate Actions Required

Restrict rule creation permissions to trusted administrators only until a patched version is deployed
Audit existing rules for malicious Go or Lua scripts and remove any unauthorized entries
Rotate secrets, API tokens, and database credentials accessible from the Rules Engine environment
Isolate the Rules Engine on a network segment with egress filtering to prevent SSRF to internal services

Patch Information

Refer to the Magistrala GitHub repository for the latest releases and security advisories. Apply the vendor-supplied patch that removes dangerous standard library exposure from the Yaegi interpreter and disables the db, ioutil, filepath, and HTTP client preloads in the Lua engine.

Workarounds

Disable the Rules Engine service if scripted rules are not required for operations
Run the Rules Engine in a hardened container with a read-only filesystem, dropped capabilities, and no access to secrets or metadata endpoints
Enforce strict role-based access control so that only vetted operators can create or modify rules
Apply network policies that deny egress from the Rules Engine to internal microservices and cloud metadata services

bash

# Configuration example: restrict Rules Engine container egress and filesystem
# Kubernetes NetworkPolicy denying egress to internal services and metadata
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: magistrala-re-egress-restrict
spec:
  podSelector:
    matchLabels:
      app: magistrala-rules-engine
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16