CVE-2026-77056

boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation. This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.

• CWE-1392

• https://boneio.eu/en/docs/black
• https://cert.pl/en/posts/2026/10/CVE-2026-77052

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77050An issue was discovered in Django 6.1 before 6.1.2, 6.0 befo…5.3
• CVE-2026-77051Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2026-77052boneIO Black exposes a Node-RED instance without authenticat…8.7
• CVE-2026-77053boneIO Black firmware ships with authentication disabled by …8.7
• CVE-2026-77054boneIO Black stores passwords, including the MQTT broker and…6.9
• CVE-2026-77055boneIO black_debian_images gives the boneio service account …9.3
• CVE-2026-77057boneIO Black does not limit authentication attempts on its w…2.3
• CVE-2026-77058boneIO Black is vulnerable to Cross-Site Request Forgery (CS…5.1
• CVE-2026-77059boneIO Black contains a TOCTOU race condition in the create_…8.8
• CVE-2026-7706A vulnerability has been found in Open5GS up to 2.7.7. This …4.3
• CVE-2026-77060boneIO black_debian_images stores the Mosquitto MQTT broker …6.8
• CVE-2026-77061boneIO Black directly excludes several API endpoints from th…5.3