CVE-2026-71235

Summary

The flaw allows authenticated users to execute arbitrary Lua scripts, leading to remote code execution (RCE) and potential data exfiltration or system compromise.

Exploitability

Exploitation is relatively straightforward for authenticated users with access to the rules engine, requiring only the ability to craft and submit Lua scripts.

Blast radius

If exploited, the impact could be severe, potentially leading to full control over the affected system and data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Lua script feature or restrict access to the rules engine to only trusted users.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.