PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7368 Yarbo CVE debrief

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

Vendor
Yarbo
Product
Yarbo Android/IOS mobile application
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-06-11
Advisory published
2026-06-11
Advisory updated
2026-06-11

Who should care

Users of Yarbo cloud and administrators of robot fleets using Yarbo cloud should be aware of this vulnerability and take immediate action to secure their systems.

Technical summary

The Yarbo cloud lacks per-device and per-user authorization, allowing clients with valid credentials to access all robots globally and publish to any robot's command topic.

Defensive priority

HIGH

Recommended defensive actions

  • Implement per-device and per-user authorization in the Yarbo cloud.
  • Remove or rotate hard-coded credentials.
  • Monitor robot telemetry streams for unauthorized access.
  • Restrict access to command topics using robot serial numbers.

Evidence notes

The CVE-2026-7368 record and NVD detail provide information on this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7368 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7368

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7368 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7368

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.