{"id":"CVE-2026-77060","kind":"vulnerability","aliases":["CVE-2026-77060"],"related":[],"title":"boneIO Debian images expose Mosquitto MQTT password hashes to local users","description":"boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.\n\nThis issue was fixed in version 1.6.0.","summary":"The boneIO black_debian_images build stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user on the machine can read the password hashes for all MQTT accounts and crack them offline.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boneio","debian","infrastructure","iot","mosquitto","mqtt","self-hosted"],"not_affected_if":["mqtt-anonymous","no-local-users","not-boneio"],"how_to_check":"- Run `ls -l /etc/mosquitto/passwd` and check whether the other-read bit is set\n- Check the boneIO version installed on the device; affected builds are below `1.6.0`","fix":"- Upgrade boneIO black_debian_images to `1.6.0` or later\n- Change the MQTT broker passwords after upgrading, since the hashes may already have been read","status":"open","published_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:46+00:00","updated_at":"2026-10-26T16:03:46+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-26T16:03:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade boneIO black_debian_images to `1.6.0` or later\n- Change the MQTT broker passwords after upgrading, since the hashes may already have been read","reach":"local","title":"boneIO Debian images expose Mosquitto MQTT password hashes to local users","impact":"medium","summary":"The boneIO black_debian_images build stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user on the machine can read the password hashes for all MQTT accounts and crack them offline.","category":"infrastructure","nicknames":[],"who_cares":["boneio","mosquitto","mqtt","self-hosted","debian","iot"],"confidence":0.8,"needs_auth":"yes","worst_case":"Local user reads MQTT password hashes and cracks them offline","analyst_note":"","how_to_check":"- Run `ls -l /etc/mosquitto/passwd` and check whether the other-read bit is set\n- Check the boneIO version installed on the device; affected builds are below `1.6.0`","needs_analyst":false,"not_affected_if":["no-local-users","not-boneio","mqtt-anonymous"],"who_is_affected":"Devices running boneIO black_debian_images on a Debian image, where the Mosquitto broker uses a password file for authentication. Exposure needs a local user account on the device, so systems where only trusted administrators log in carry less risk. Teams that do not run boneIO or Mosquitto with password authentication can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3323,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-77060':14A,17A '/etc/mosquitto/passwd':41B,78C '1.6.0':107C 'account':61B,95C 'attack':100C 'black':29B,67C 'boneio':1A,18B,28B,66C 'broker':37B,74C 'build':32B 'crack':63B 'cve':12A,15A 'debian':2A,19B,30B,68C 'dictionari':99C 'expos':4A 'file':39B,76C 'fix':104C 'hash':8A,57B,91C 'host':26B 'imag':3A,31B,69C 'infrastructur':20B 'iot':21B 'issu':102C 'local':10A,48B,85C 'machin':52B 'mosquitto':5A,22B,35B,72C 'mqtt':6A,23B,36B,60B,73C,94C 'offlin':65B,98C 'password':7A,38B,56B,75C,90C 'perform':97C 'permiss':46B,83C 'read':54B,88C 'readabl':45B,82C 'self':25B 'self-host':24B 'store':33B,70C 'user':11A,49B,86C 'version':106C 'world':44B,81C 'world-read':43B,80C","nicknames":[],"mitigations":[],"who_affected":"Devices running boneIO black_debian_images on a Debian image, where the Mosquitto broker uses a password file for authentication. Exposure needs a local user account on the device, so systems where only trusted administrators log in carry less risk. Teams that do not run boneIO or Mosquitto with password authentication can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77060","severity":null,"published_at":"2026-10-26T15:16:43+00:00","modified_at":"2026-10-26T15:16:43+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}