{"id":"CVE-2026-77055","kind":"vulnerability","aliases":["CVE-2026-77055"],"related":[],"title":"boneIO Debian images give service account passwordless root via sudo","description":"boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.\n\nThis issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.","summary":"The boneIO black_debian_images grant the boneio service account full passwordless sudo and docker group membership. A local attacker who compromises that account can escalate to root.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["black-debian-images","boneio","linux","other","self-hosted"],"not_affected_if":["boneio-1.6.0-or-later","not-using-black-debian-images"],"how_to_check":"- Run `sudo -l -U boneio` on the device and look for `NOPASSWD: ALL`.\n- Run `id boneio` and check whether the `docker` group is listed.\n- Check the installed boneIO version against `1.6.0`.","fix":"- Upgrade boneIO to `1.6.0` or later; its migrations remove the sudoers rule and docker group membership on first start.\n- Confirm the migrations ran after the upgrade by re-running the checks above.","status":"open","published_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:32+00:00","updated_at":"2026-10-26T16:03:32+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-26T16:03:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade boneIO to `1.6.0` or later; its migrations remove the sudoers rule and docker group membership on first start.\n- Confirm the migrations ran after the upgrade by re-running the checks above.","reach":"local","title":"boneIO Debian images give service account passwordless root via sudo","impact":"high","summary":"The boneIO black_debian_images grant the boneio service account full passwordless sudo and docker group membership. A local attacker who compromises that account can escalate to root.","category":"other","nicknames":[],"who_cares":["boneio","black-debian-images","self-hosted","linux"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker who controls boneio user gains root on the device","analyst_note":"","how_to_check":"- Run `sudo -l -U boneio` on the device and look for `NOPASSWD: ALL`.\n- Run `id boneio` and check whether the `docker` group is listed.\n- Check the installed boneIO version against `1.6.0`.","needs_analyst":false,"not_affected_if":["boneio-1.6.0-or-later","not-using-black-debian-images"],"who_is_affected":"Devices running boneIO built from the black_debian_images before 1.6.0, where the boneio service account has the sudoers rule and docker group membership. Anyone with a local account or a foothold as the boneio user is in scope; systems not running these images can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000604,"input_tokens":3412,"output_tokens":525,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77055':13A,16A '1.6.0':99C,129C 'accept':145C 'access':70C 'account':6A,36B,50B,63C 'alreadi':117C 'appli':131C 'attack':46B,79C 'black':18B,29B,56C 'black-debian-imag':17B 'boneio':1A,21B,28B,34B,55C,61C,83C,128C 'command':151C 'compromis':48B,81C 'cve':11A,14A 'debian':2A,19B,30B,57C 'devic':116C 'docker':41B,75C,108C 'ed25519':156C 'escal':52B,90C 'excess':64C 'field':120C 'first':133C 'fix':96C,148C 'full':37B,67C 'give':4A,59C 'go':141C 'grant':32B 'group':42B,76C,109C 'helper':143C 'host':26B 'imag':3A,20B,31B,58C,101C 'includ':66C 'issu':94C 'linux':22B 'local':45B,78C 'membership':43B,72C,110C 'migrat':125C,153C 'oper':139C 'passwordless':7A,38B,68C 'privileg':65C,88C,138C 'remov':102C,123C 'root':8A,54B,92C 'rule':105C 'seal':114C 'self':25B 'self-host':24B 'servic':5A,35B,62C 'set':149C 'ship':126C 'signatur':157C 'start':134C 'sudo':10A,39B,69C 'sudoer':104C 'upgrad':137C 'use':86C 'user':84C 'verifi':154C 'version':98C 'via':9A","nicknames":[],"mitigations":[],"who_affected":"Devices running boneIO built from the black_debian_images before 1.6.0, where the boneio service account has the sudoers rule and docker group membership. Anyone with a local account or a foothold as the boneio user is in scope; systems not running these images can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77055","severity":null,"published_at":"2026-10-26T15:16:43+00:00","modified_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}