CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device. This allows the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device, causing loss of integrity and availability. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website. This issue was fixed in version 1.6.0.

• CWE-352

• https://boneio.eu/en/docs/black
• https://cert.pl/en/posts/2026/10/CVE-2026-77052

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77052boneIO Black exposes a Node-RED instance without authenticat…8.7
• CVE-2026-77053boneIO Black firmware ships with authentication disabled by …8.7
• CVE-2026-77054boneIO Black stores passwords, including the MQTT broker and…6.9
• CVE-2026-77055boneIO black_debian_images gives the boneio service account …9.3
• CVE-2026-77056boneIO black_debian_images ships with a Mosquitto MQTT broke…7.1
• CVE-2026-77057boneIO Black does not limit authentication attempts on its w…2.3
• CVE-2026-77059boneIO Black contains a TOCTOU race condition in the create_…8.8
• CVE-2026-7706A vulnerability has been found in Open5GS up to 2.7.7. This …4.3
• CVE-2026-77060boneIO black_debian_images stores the Mosquitto MQTT broker …6.8
• CVE-2026-77061boneIO Black directly excludes several API endpoints from th…5.3
• CVE-2026-77062The boneIO Black web interface lacks proper clickjacking pro…6.9
• CVE-2026-77063multer is a middleware for handling multipart/form-data in N…3.7