CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.

• CWE-306

• https://boneio.eu/en/docs/black
• https://cert.pl/en/posts/2026/10/CVE-2026-77052

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77036A vulnerability was found in elunez eladmin up to 2.7. The i…6.3
• CVE-2026-77037multer is a middleware for handling multipart/form-data in N…7.5
• CVE-2026-7704A vulnerability has been found in AV Stumpfl Pixera Two Medi…4.3
• CVE-2026-7705A flaw has been found in JD Cloud JDCOS 4.5.1.r4518. This vu…6.3
• CVE-2026-77050An issue was discovered in Django 6.1 before 6.1.2, 6.0 befo…5.3
• CVE-2026-77051Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2026-77053boneIO Black firmware ships with authentication disabled by …8.7
• CVE-2026-77054boneIO Black stores passwords, including the MQTT broker and…6.9
• CVE-2026-77055boneIO black_debian_images gives the boneio service account …9.3
• CVE-2026-77056boneIO black_debian_images ships with a Mosquitto MQTT broke…7.1
• CVE-2026-77057boneIO Black does not limit authentication attempts on its w…2.3
• CVE-2026-77058boneIO Black is vulnerable to Cross-Site Request Forgery (CS…5.1