{"id":"CVE-2026-77056","kind":"vulnerability","aliases":["CVE-2026-77056"],"related":[],"title":"boneIO image: Mosquitto broker ships with public default MQTT credentials","description":"boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.\n\nThis issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.","summary":"The boneIO black_debian_images build runs a Mosquitto MQTT broker with the same default username and password on every device, and those credentials are published on GitHub. A remote attacker who logs in can read and write all broker topics, switching connected relays, blinds and gates and injecting fake entities into a linked Home Assistant.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["beaglebone","boneio","home-assistant","infrastructure","iot","mosquitto","mqtt","self-hosted"],"not_affected_if":["isolated-network","version-1.6.0-or-later"],"how_to_check":"- Open the boneIO web panel and look for a warning that MQTT credentials are still the published defaults.\n- Check whether the device was installed before `1.6.0`, since upgraded devices keep their old broker credentials.\n- Test whether the default broker login is still accepted on the device's MQTT port.","fix":"- Upgrade the boneIO black_debian_images image to `1.6.0` or later, which generates per-device MQTT passwords at first boot.\n- On devices upgraded from earlier versions, change the Mosquitto MQTT password from the boneIO web panel, since the old defaults are kept.","status":"open","published_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:43+00:00","updated_at":"2026-10-26T16:03:43+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-26T16:03:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the boneIO black_debian_images image to `1.6.0` or later, which generates per-device MQTT passwords at first boot.\n- On devices upgraded from earlier versions, change the Mosquitto MQTT password from the boneIO web panel, since the old defaults are kept.","reach":"network","title":"boneIO image: Mosquitto broker ships with public default MQTT credentials","impact":"high","summary":"The boneIO black_debian_images build runs a Mosquitto MQTT broker with the same default username and password on every device, and those credentials are published on GitHub. A remote attacker who logs in can read and write all broker topics, switching connected relays, blinds and gates and injecting fake entities into a linked Home Assistant.","category":"infrastructure","nicknames":[],"who_cares":["boneio","mosquitto","mqtt","home-assistant","beaglebone","self-hosted","iot"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker controls relays, blinds and gates and injects fake Home Assistant entities","analyst_note":"Confirm the exact affected version range and whether the broker port is exposed by default; the NVD entry is the only source given.","how_to_check":"- Open the boneIO web panel and look for a warning that MQTT credentials are still the published defaults.\n- Check whether the device was installed before `1.6.0`, since upgraded devices keep their old broker credentials.\n- Test whether the default broker login is still accepted on the device's MQTT port.","needs_analyst":true,"not_affected_if":["version-1.6.0-or-later","isolated-network"],"who_is_affected":"Teams running boneIO on BeagleBone-based boards built from the black_debian_images image that expose the Mosquitto broker to a network they do not fully control. Devices on an isolated network with no remote access are at lower risk, and devices already on 1.6.0 or later with regenerated credentials are not affected by the default-credential issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":3447,"output_tokens":707,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77056':13A,16A '1.6.0':163C,188C 'access':134C 'allow':138C 'assist':21B,84B,155C 'attack':59B,124C 'beaglebon':17B 'black':31B,86C 'blind':73B,143C 'boneio':1A,18B,30B,85C,187C 'boot':175C 'broker':4A,39B,68B,94C,137C,184C 'build':34B 'chang':120C,205C 'connect':71B,141C 'control':139C 'credenti':10A,52B,100C,105C,185C,193C 'cve':11A,14A 'debian':32B,87C 'default':8A,43B,99C,199C 'devic':49B,103C,172C,176C 'document':108C 'earlier':179C 'entiti':79B,150C 'everi':48B 'exist':183C 'fake':78B,149C 'first':174C 'fix':160C 'full':130C 'gain':129C 'gate':75B,145C 'generat':170C 'github':56B,110C 'home':20B,83B,154C 'home-assist':19B 'host':28B 'imag':2A,33B,88C,166C 'indic':115C 'infrastructur':22B 'inject':77B,147C 'instal':156C 'instruct':118C 'iot':23B 'issu':158C 'keep':181C 'link':82B,153C 'log':61B 'mosquitto':3A,24B,37B,92C 'mqtt':9A,25B,38B,93C,167C 'owner':202C 'panel':191C 'password':46B,168C 'per':171C 'public':7A,107C 'publish':54B,198C 'read':64B,131C 'relay':72B,142C 'remot':58B,123C 'report':192C 'run':35B 'self':27B 'self-host':26B 'ship':5A,89C 'still':196C 'switch':70B 'topic':69B 'upgrad':177C 'use':96C,126C 'usernam':44B 'version':162C,180C 'web':190C 'write':66B,133C","nicknames":[],"mitigations":[],"who_affected":"Teams running boneIO on BeagleBone-based boards built from the black_debian_images image that expose the Mosquitto broker to a network they do not fully control. Devices on an isolated network with no remote access are at lower risk, and devices already on 1.6.0 or later with regenerated credentials are not affected by the default-credential issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77056","severity":null,"published_at":"2026-10-26T15:16:43+00:00","modified_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}