CVE-2026-71284: Fledge Backup Restore RCE Vulnerability

CVE-2026-71284 Overview

CVE-2026-71284 is a command injection vulnerability in Fledge, an open-source Internet of Things (IoT) data platform. The flaw resides in the upload_backup() function within python/fledge/services/core/api/backup_restore.py. The handler constructs a shell command using Python string formatting with an attacker-controlled tar member filename, then passes it to os.system(). An authenticated administrator uploading a crafted backup archive can inject arbitrary shell commands. The vulnerability is classified under [CWE-78] (OS Command Injection).

Critical Impact
Authenticated administrators can achieve arbitrary operating system command execution on the Fledge host by uploading a specially crafted backup archive.

Affected Products

Fledge IoT platform (backup-restore API component)
python/fledge/services/core/api/backup_restore.py upload handler
Deployments exposing the administrative backup upload endpoint

Discovery Timeline

2026-08-05 - CVE-2026-71284 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71284

Vulnerability Analysis

The upload_backup() handler in Fledge processes uploaded tar archives that contain backup files. After extracting members, the handler selects the first filename from tar_file_names[0] and interpolates it directly into a shell command string: cmd = "cp {} {}".format(source, backup_path). The resulting command is executed via os.system(), which spawns a shell interpreter. Because the filename originates from the uploaded archive and is not quoted or escaped, shell metacharacters embedded in the filename are interpreted by the shell rather than treated as literal characters.

An attacker with administrative access uploads an archive containing a member such as fledge_backup_$(id>/tmp/pwn).db. The name passes the handler's validation because it starts with the expected backup_prefix and ends with a value in valid_extensions. When the shell parses the constructed cp command, it evaluates the $(...) command substitution and executes the injected payload with the privileges of the Fledge service.

Root Cause

The root cause is unsafe command construction combined with insufficient input validation. The only checks applied to the filename are startswith(backup_prefix) and endswith(valid_extensions). Neither check rejects shell metacharacters such as $, `, ;, |, or &. The code uses os.system() instead of a list-form subprocess.run([...]) invocation and does not apply shlex.quote() to untrusted values.

Attack Vector

Exploitation requires authenticated administrative access to the Fledge management API. The attacker crafts a tar archive whose first member has a filename that satisfies the prefix and suffix checks while embedding a shell command substitution or metacharacter sequence. Uploading the archive through the backup upload endpoint triggers the vulnerable cp execution. The injected commands run in the security context of the Fledge process, enabling data theft, service disruption, or lateral movement across the IoT deployment.

See the Fledge backup-restore source for the affected handler implementation.

Detection Methods for CVE-2026-71284

Indicators of Compromise

Backup archive members whose filenames contain shell metacharacters such as $(, `, ;, |, &, or > while still matching the backup naming pattern.
Unexpected child processes spawned by the Fledge service user immediately following a call to the backup upload endpoint.
New files, scripts, or artifacts written to world-writable directories such as /tmp shortly after an upload event.
Outbound network connections initiated by the Fledge process to previously unseen destinations.

Detection Strategies

Inspect Fledge API access logs for POST requests to the backup upload endpoint and correlate them with subsequent shell process creation on the host.
Monitor process ancestry for sh or bash invocations that descend from the Fledge Python service and execute commands beyond a simple cp.
Apply file integrity monitoring on the backup directory and adjacent paths to catch unauthorized writes triggered by injected commands.

Monitoring Recommendations

Enable auditd or equivalent process auditing on hosts running Fledge and alert on execve events referencing shell metacharacters in argument vectors.
Log all administrative authentication events against the Fledge API and alert on rare or off-hours upload activity.
Retain uploaded archive metadata, including member filenames, for retrospective hunting when new indicators are published.

How to Mitigate CVE-2026-71284

Immediate Actions Required

Restrict access to the Fledge administrative API to trusted networks and enforce strong authentication for administrator accounts.
Disable or firewall the backup upload endpoint until a patched version is deployed if administrative uploads are not operationally required.
Review recent uploads and host activity for indicators of prior exploitation before applying updates.
Rotate credentials and secrets accessible to the Fledge service if compromise is suspected.

Patch Information

At the time of publication, upstream fix information was not included in the NVD entry. Track the Fledge IoT project repository for updates to backup_restore.py that replace os.system() with a list-form subprocess call and apply shlex.quote() or strict allowlist validation to archive member filenames.

Workarounds

Place the Fledge management interface behind a VPN or bastion host and limit administrative accounts to a minimal set of operators.
Add a reverse proxy rule that inspects uploaded archives and rejects any tar member whose filename contains shell metacharacters.
Run the Fledge service under a dedicated low-privilege user with no interactive shell and strict filesystem permissions to constrain the impact of successful command injection.

bash

# Example: run Fledge under a restricted service account with no shell
sudo useradd --system --shell /usr/sbin/nologin --home /var/lib/fledge fledge-svc
sudo chown -R fledge-svc:fledge-svc /var/lib/fledge
# Optionally restrict network exposure of the admin API to localhost or a management VLAN