CVE-2026-77060 boneIO CVE debrief

Who should care

System administrators and security teams responsible for boneIO black_debian_images deployments should assess exposure and prioritize updating to version 1.6.0 or later. They should also review local access controls and permissions for Mosquitto MQTT broker password file, restrict access to password hashes, and consider re-hashing passwords.

Why it matters

CVE-2026-77060 allows local users to read Mosquitto MQTT broker password hashes due to world-readable permissions in boneIO black_debian_images. System administrators and security teams should assess exposure, prioritize updating to version 1.6.0 or later, and consider re-hashing passwords.

• Local attackers can access sensitive password hashes
• Offline dictionary attacks are feasible with accessible password hashes
• Version 1.6.0 or later is required for fix

Technical summary

The boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions, allowing local users to read password hashes and perform offline dictionary attacks. This issue was fixed in version 1.6.0. System administrators and security teams should assess exposure and prioritize updating to version 1.6.0 or later. Local attackers can access sensitive password hashes and perform offline dictionary attacks. Version 1.6.0 or later is required for fix. The issue is a critical resource vulnerability in boneIO.

Defensive priority

Medium priority for local access control review and password management

Recommended defensive actions

• Review local access controls and permissions for Mosquitto MQTT broker password file
• Update to version 1.6.0 or later of boneIO black_debian_images
• Restrict access to password hashes and consider re-hashing passwords
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Official CVE Program record and NVD vulnerability detail page confirm world-readable permissions for Mosquitto MQTT broker password file. The CVE record was published on 2026-10-26T14:46:06.547Z and has not been modified since then. The source item for CVE-2026-77060 is from cve_program_cvelist_v5. Supplemental source references are also available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.