Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

emqx/emqx

              master @ 3ada62f
            

271

Fixes

CVEs

CRITICAL

Peak severity

29.0%

Coverage

Highlights

Auth Bypass: 131 prior fixes. Scrutinize any change in this area.

apps/emqx/src/emqx_persistent_session_ds.erl: most-fixed (9 issues). Treat as high-risk during review.

116 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Fragile RBAC checks, template mismatching in route parameters, and failure-prone path-matching instead of handler-info-based authorization have historically allowed namespaced administrators and regular users to escalate privileges or access cross-tenant resources.

Auth Bypass: Clients could bypass authorization or publish unauthorized Last Will and Testament (LWT) messages because of premature registration of the Will message prior to successful authentication, or failure to perform ACL checks upon kicking banned clients.

Denial of Service: Erlang-specific denial of service vectors including dynamic atom generation from untrusted packet payloads or configuration fields (exhausting the Erlang VM atom table) and parsing crashes in lexer engines handling complex or unmatched control characters.