Vulnerability in Yarbo Mobile Applications Affecting MQTT Broker Credentials
CVE-2026-10557

9.3CRITICAL

Key Information:

Vendor

Yarbo

Status
Yarbo Android/iOS Mobile Application
Yarbo Cloud MQtt Infrastructure
Vendor
CVE Published:
12 June 2026

What is CVE-2026-10557?

The Yarbo mobile applications for Android and iOS contain hard-coded MQTT broker credentials, which are identical across all users and devices. This vulnerability allows easy extraction of the credentials through APK decompilation, granting unauthorized access to cloud MQTT brokers that manage real-time telemetry for the entire Yarbo robot fleet. Once compromised, attackers can subscribe to all robot telemetry topics and publish commands to any robot using only its serial number, leading to significant potential disruptions and privacy violations.

Affected Version(s)

Yarbo Android/IOS mobile application 0 < 3.17.4

Yarbo Cloud MQTT infrastructure All

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Markus Lassfolk of Truesec reported this vulnerability to CISA.
.