CVE-2026-77056 Use of Default Credentials in boneIO
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-77056?
CVE-2026-77056 is a high-severity vulnerability in boneIO black_debian_images, published on 26 Oct 2026.
Official description
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation.
This issue was fixed in version 1.6.0 of the image: MQTT passwords are generated per device at first boot. Devices upgraded from earlier versions keep their existing broker credentials; from boneio 1.6.0 the web panel reports credentials that are still the published defaults, and the owner has to change them.
Weakness: CWE-1392
Which versions are affected by CVE-2026-77056?
How do I fix CVE-2026-77056?
No fix has been published for CVE-2026-77056 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77056 being exploited?
There is no known exploitation of CVE-2026-77056 in the wild and no public exploit code.
Sources
Also known as GHSA-m3h7-g9v5-p62c.