The flaw arises from the ability of the Emqx plugin‑install REST API and the dashboard upload feature to accept stale grants. Grants that were issued more than five minutes earlier, or that were created without a SHA‑256 package binding, remain valid and can be leveraged to install arbitrary .tar.gz files. An attacker who has a dashboard administrator credential or an API key that includes plugin‑install permission can identify a stale grant that references an allowed name and version, then POST a malicious .tar.gz to /api/v5/plugins/install or upload it through the dashboard. The broker subsequently installs and executes the attacker‑supplied Erlang code with the same privileges as the EMQX process, resulting in full remote code execution with escalated privileges.

The vulnerability affects all EMQX releases older than the following versions: 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1. Any deployment running a pre‑5.8.11, pre‑5.9.3, etc. build is thus susceptible. The affected component is the plugin installation path that does not enforce a limited grant lifetime or package binding.

The flaw carries a CVSS score of 6.6, indicating medium severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the current risk of exploitation is uncertain. Nonetheless, the attack requires privileged access: a compromised dashboard administrator or an API key with plugin‑install rights. Once those credentials are obtained, the attacker can immediately elevate themselves to full control of the Emqx process. The lack of a grant time‑to‑live or binding check makes the window for successful exploitation significant but limited to systems with stale grants that remain in the database.