---
id: "CVE-2026-77060"
kind: "vulnerability"
aliases: ["CVE-2026-77060"]
title: "boneIO Debian images expose Mosquitto MQTT password hashes to local users"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["boneio", "debian", "infrastructure", "iot", "mosquitto", "mqtt", "self-hosted"]
not_affected_if: ["mqtt-anonymous", "no-local-users", "not-boneio"]
published_at: "2026-10-26T15:16:43+00:00"
first_seen_at: "2026-10-26T16:02:26+00:00"
updated_at: "2026-10-26T16:03:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77060", "first_seen_at": "2026-10-26T16:02:26+00:00"}]
---

# boneIO Debian images expose Mosquitto MQTT password hashes to local users

The boneIO black_debian_images build stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user on the machine can read the password hashes for all MQTT accounts and crack them offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ls -l /etc/mosquitto/passwd` and check whether the other-read bit is set
- Check the boneIO version installed on the device; affected builds are below `1.6.0`

## Fix

- Upgrade boneIO black_debian_images to `1.6.0` or later
- Change the MQTT broker passwords after upgrading, since the hashes may already have been read

## Timeline

- 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77060

## From the sources

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.

This issue was fixed in version 1.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_