Live › vulnerability › CVE-2026-77055
Go to dashboardThe boneIO black_debian_images grant the boneio service account full passwordless sudo and docker group membership. A local attacker who compromises that account can escalate to root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Devices running boneIO built from the black_debian_images before 1.6.0, where the boneio service account has the sudoers rule and docker group membership. Anyone with a local account or a foothold as the boneio user is in scope; systems not running these images can skip it.
No product ranges from the sources yet.
sudo -l -U boneio on the device and look for NOPASSWD: ALL.id boneio and check whether the docker group is listed.1.6.0.1.6.0 or later; its migrations remove the sudoers rule and docker group membership on first start.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.
This page as .md · .json · in your agent: get_signal("CVE-2026-77055")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.