---
id: "CVE-2026-77054"
kind: "vulnerability"
aliases: ["CVE-2026-77054"]
title: "boneIO Black: config API exposes MQTT and web panel passwords in cleartext"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["boneio", "home-automation", "infrastructure", "iot", "mqtt", "self-hosted"]
not_affected_if: ["isolated-network", "version-1.6.0-or-later"]
published_at: "2026-10-26T15:16:42+00:00"
first_seen_at: "2026-10-26T16:02:25+00:00"
updated_at: "2026-10-26T16:03:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77054", "first_seen_at": "2026-10-26T16:02:25+00:00"}]
---

# boneIO Black: config API exposes MQTT and web panel passwords in cleartext

boneIO Black stores its MQTT broker and web panel passwords in cleartext and returns them from GET /api/config. Any authenticated user, and when authentication is disabled by default, any unauthenticated attacker on the local network, can read those administrative passwords.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed boneIO version and confirm whether it is below `1.6.0`.
- Call `GET /api/config` on the panel and see whether the response contains password values.
- Check whether authentication is enabled in the boneIO web panel settings.

## Fix

- Upgrade boneIO Black to `1.6.0` or later, which stores web panel passwords as salted scrypt hashes and stops returning secret values from the API and logs.
- Change the MQTT broker password and web panel passwords after upgrading, since older values were exposed in cleartext.
- Enable authentication on the web panel, since the sibling issue CVE-2026-77053 leaves it disabled by default.

## Timeline

- 2026-10-26T16:02:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77054

## From the sources

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords.

This issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_