{"id":"CVE-2026-77054","kind":"vulnerability","aliases":["CVE-2026-77054"],"related":[],"title":"boneIO Black: config API exposes MQTT and web panel passwords in cleartext","description":"boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords.\n\nThis issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.","summary":"boneIO Black stores its MQTT broker and web panel passwords in cleartext and returns them from GET /api/config. Any authenticated user, and when authentication is disabled by default, any unauthenticated attacker on the local network, can read those administrative passwords.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boneio","home-automation","infrastructure","iot","mqtt","self-hosted"],"not_affected_if":["isolated-network","version-1.6.0-or-later"],"how_to_check":"- Check the installed boneIO version and confirm whether it is below `1.6.0`.\n- Call `GET /api/config` on the panel and see whether the response contains password values.\n- Check whether authentication is enabled in the boneIO web panel settings.","fix":"- Upgrade boneIO Black to `1.6.0` or later, which stores web panel passwords as salted scrypt hashes and stops returning secret values from the API and logs.\n- Change the MQTT broker password and web panel passwords after upgrading, since older values were exposed in cleartext.\n- Enable authentication on the web panel, since the sibling issue CVE-2026-77053 leaves it disabled by default.","status":"open","published_at":"2026-10-26T15:16:42+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:46+00:00","updated_at":"2026-10-26T16:03:46+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-26T16:03:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade boneIO Black to `1.6.0` or later, which stores web panel passwords as salted scrypt hashes and stops returning secret values from the API and logs.\n- Change the MQTT broker password and web panel passwords after upgrading, since older values were exposed in cleartext.\n- Enable authentication on the web panel, since the sibling issue CVE-2026-77053 leaves it disabled by default.","reach":"network","title":"boneIO Black: config API exposes MQTT and web panel passwords in cleartext","impact":"medium","summary":"boneIO Black stores its MQTT broker and web panel passwords in cleartext and returns them from GET /api/config. Any authenticated user, and when authentication is disabled by default, any unauthenticated attacker on the local network, can read those administrative passwords.","category":"infrastructure","nicknames":[],"who_cares":["boneio","self-hosted","home-automation","mqtt","iot"],"confidence":0.8,"needs_auth":"no","worst_case":"unauthenticated attacker reads MQTT broker and web panel passwords","analyst_note":"","how_to_check":"- Check the installed boneIO version and confirm whether it is below `1.6.0`.\n- Call `GET /api/config` on the panel and see whether the response contains password values.\n- Check whether authentication is enabled in the boneIO web panel settings.","needs_analyst":false,"not_affected_if":["version-1.6.0-or-later","isolated-network"],"who_is_affected":"Teams running boneIO Black on a local network, especially where the web panel is reachable from other devices and authentication is left disabled. Installations behind authentication still expose passwords to any logged-in user. Teams on version 1.6.0 or later are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3477,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A,116C '-77053':117C '-77054':15A,18A '/api/config':46B,85C '1.6.0':140C 'access':105C 'account':158C,200C 'administr':67B,107C 'api':4A,161C,208C 'applic':179C 'attack':59B,124C 'authent':48B,52B,98C,118C 'autom':22B 'black':2A,30B,70C 'boneio':1A,19B,29B,69C 'broker':34B,76C,171C,184C 'call':101C 'cleartext':12A,40B,82C,110C 'client':187C 'config':3A 'configur':90C 'critic':112C 'cve':13A,16A,115C 'default':56B,121C 'disabl':54B,119C 'due':113C 'endpoint':86C,103C 'expos':5A,96C,205C 'file':152C,194C 'fix':137C 'form':111C 'full':89C 'get':45B,84C 'hash':149C 'home':21B 'home-autom':20B 'host':28B 'includ':73C 'infrastructur':23B 'iot':24B 'issu':135C 'kept':190C 'local':62B,128C 'log':163C 'longer':165C,204C 'mqtt':6A,25B,33B,75C,170C 'network':63B,129C 'panel':9A,37B,79C,142C 'password':10A,38B,68B,72C,80C,95C,108C,133C,143C,172C 'present':180C 'read':65B 'readabl':153C,195C 'recover':176C 'retriev':131C 'return':42B,87C,166C 'salt':147C 'scrypt':148C 'secret':167C 'self':27B 'self-host':26B 'separ':193C 'servic':94C,157C,199C 'stay':175C 'store':31B,71C,145C 'sub':93C 'sub-servic':92C 'unauthent':58B,123C 'user':49B,99C 'valu':168C 'version':139C 'web':8A,36B,78C,141C","nicknames":[],"mitigations":[],"who_affected":"Teams running boneIO Black on a local network, especially where the web panel is reachable from other devices and authentication is left disabled. Installations behind authentication still expose passwords to any logged-in user. Teams on version 1.6.0 or later are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77054","severity":null,"published_at":"2026-10-26T15:16:42+00:00","modified_at":"2026-10-26T15:16:42+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}