CVE-2026-71235 affects Magistrala's Rules Engine, which allows authenticated users to embed Go or Lua scripts executed server-side upon IoT message arrival. The Go script engine uses the Yaegi interpreter with full stdlib access, and its validation only blocks goroutines and panic() calls, leaving dangerous functions like os.ReadFile, os.WriteFile, os.Remove, and os.Environ accessible. The Lua script engine performs no input validation whatsoever and preloads dangerous libraries including arbitrary database access, file I/O, an HTTP client enabling SSRF, and filepath traversal. Any authenticated low-privileged user can exploit this to achieve arbitrary file read/write on the server, leak environment variables (potentially exposing secrets), gain unauthorized database access, and perform SSRF attacks against internal microservices. The vulnerability represents a critical privilege escalation and lateral movement risk within IoT deployments using Magistrala. Remediation would require proper sandboxing of both script engines and strict allowlisting of accessible libraries.