Live › vulnerability › CVE-2026-77059
Go to dashboardboneIO Black writes sudoers rules to a predictable temporary file, validates them, then installs them as root, leaving a race window. A local user can swap the content or use a symlink on that filename to inject arbitrary sudoers rules and become root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Any boneIO Black installation with a version before that exposes the affected timezone route is exposed to a local attacker with a shell on the device. Hosts where only trusted administrators log in have a much smaller risk. The sources do not say whether the web UI route must be reached for the race to be triggered.
1.6.0No product ranges from the sources yet.
1.6.0.boneio/webui/routes/timezone_sudoers.py exists and contains create_timedatectl_sudoers_file(), which the sources name as the affected function.1.6.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root.
This issue was fixed in version 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77059")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.