PT-2026-41527 · Emqx · Emqx

Cccaaa · Published 2026-05-17 · Updated 2026-05-20 · CVE-2026-8741

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions EMQX versions prior to 6.2.0

Description A race condition exists in the QoS 2 PUBLISH Packet Handler component within the apps/emqx/src/emqx persistent session ds.erl file. This issue allows a remote attacker to trigger a race condition, which occurs when the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events. This attack is characterized by high complexity and is difficult to exploit.

Recommendations Update to a version later than 6.2.0. As a temporary workaround, restrict access to the QoS 2 PUBLISH Packet Handler component to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-8741

Affected Products

Emqx

References · 10

• 🔥 https://github.com/Pathfind-tama/Report_EMQX_MQTT/blob/main/MQTT%20QoS%202%20Message%20Duplication%20in%20Persistent%20Sessions.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8741 · Security Note
• https://vuldb.com/vuln/364329 · Note
• https://github.com/Pathfind-tama/Report_EMQX_MQTT · Note
• https://vuldb.com/submit/809931 · Note
• https://twitter.com/VulmonFeeds/status/2055946355814617387 · Twitter Post
• https://t.me/cveNotify/163770 · Telegram Post
• https://vuldb.com/vuln/364329/cti · Note
• https://t.me/cveNotify/164305 · Telegram Post
• https://t.me/CVEtracker/54040 · Telegram Post