CVE-2026-10557

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.

• CWE-798

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105562Time-of-check time-of-use (toctou) race condition in Windows…4.7
• CVE-2026-105565Use after free in Windows MIDI Service Module allows an auth…7
• CVE-2026-105566Concurrent execution using shared resource with improper syn…7
• CVE-2026-105567Use after free in Windows Print Spooler Components allows an…7
• CVE-2026-105568Out-of-bounds read in Active Directory Domain Services allow…6.5
• CVE-2026-105569Out-of-bounds read in Windows Cloud Files Mini Filter Driver…7.8
• CVE-2026-105570Docker Sandboxes compared OAuth token-endpoint hostnames cas…6.7
• CVE-2026-105571A flaw has been found in PickMall Lilishop up to 4.2.4. The …7.3
• CVE-2026-105572A vulnerability has been found in PickMall Lilishop up to 4.…4.3
• CVE-2026-105573A vulnerability was found in newbee-ltd newbee-mall up to 2.…4.3
• CVE-2026-105574Use after free in Windows MIDI Service Module allows an auth…7
• CVE-2026-105575Access of resource using incompatible type ('type confusion'…7.8