---
id: "CVE-2026-77062"
kind: "vulnerability"
aliases: ["CVE-2026-77062"]
title: "boneIO Black: web panel can be framed, enabling clickjacked relay actions"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["boneio", "home-automation", "infrastructure", "iot", "self-hosted"]
not_affected_if: ["panel-unreachable-from-users-browsers", "version-1.6.0-or-later"]
published_at: "2026-10-26T15:16:44+00:00"
first_seen_at: "2026-10-26T16:02:26+00:00"
updated_at: "2026-10-26T16:03:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77062", "first_seen_at": "2026-10-26T16:02:26+00:00"}]
---

# boneIO Black: web panel can be framed, enabling clickjacked relay actions

The boneIO Black web control panel can be embedded in an iframe on a malicious page. A logged-in user who clicks there can be tricked into switching relays, opening gates or moving blinds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed boneIO version; the sources say the fix is in `1.6.0`
- Check whether the control panel's login is enabled, since CVE-2026-77053 says authentication is disabled by default

## Fix

- Upgrade boneIO Black to `1.6.0` or later
- Disable authentication only if you accept the risk from CVE-2026-77053; re-enable it on the panel

## Timeline

- 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77062

## From the sources

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. This can lead to unauthorized state changes with potential physical safety consequences. Critically, due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.

This issue was fixed in version 1.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_