---
id: "CVE-2026-77055"
kind: "vulnerability"
aliases: ["CVE-2026-77055"]
title: "boneIO Debian images give service account passwordless root via sudo"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["black-debian-images", "boneio", "linux", "other", "self-hosted"]
not_affected_if: ["boneio-1.6.0-or-later", "not-using-black-debian-images"]
published_at: "2026-10-26T15:16:43+00:00"
first_seen_at: "2026-10-26T16:02:25+00:00"
updated_at: "2026-10-26T16:03:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77055", "first_seen_at": "2026-10-26T16:02:25+00:00"}]
---

# boneIO Debian images give service account passwordless root via sudo

The boneIO black_debian_images grant the boneio service account full passwordless sudo and docker group membership. A local attacker who compromises that account can escalate to root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `sudo -l -U boneio` on the device and look for `NOPASSWD: ALL`.
- Run `id boneio` and check whether the `docker` group is listed.
- Check the installed boneIO version against `1.6.0`.

## Fix

- Upgrade boneIO to `1.6.0` or later; its migrations remove the sudoers rule and docker group membership on first start.
- Confirm the migrations ran after the upgrade by re-running the checks above.

## Timeline

- 2026-10-26T16:02:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77055

## From the sources

boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.

This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_