Live › vulnerability › CVE-2026-77060
Go to dashboardThe boneIO black_debian_images build stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user on the machine can read the password hashes for all MQTT accounts and crack them offline.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Devices running boneIO black_debian_images on a Debian image, where the Mosquitto broker uses a password file for authentication. Exposure needs a local user account on the device, so systems where only trusted administrators log in carry less risk. Teams that do not run boneIO or Mosquitto with password authentication can skip it.
No product ranges from the sources yet.
ls -l /etc/mosquitto/passwd and check whether the other-read bit is set1.6.01.6.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.
This issue was fixed in version 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77060")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.