Privilege Escalation Vulnerability in BoneIO Black Debian Images by BoneIO
CVE-2026-77055

9.3CRITICAL

Key Information:

Vendor

Boneio

Status
Black Debian Images
Vendor
CVE Published:
26 October 2026

What is CVE-2026-77055?

The BoneIO Black Debian Images expose the boneio service account to excessive privileges, allowing local attackers short-cuts to gain root access via full passwordless sudo capabilities and docker group membership. This vulnerability was addressed in version 1.6.0, which removes the sudoers rule and docker group membership upon sealing the image. Users are encouraged to upgrade to the latest version to mitigate these risks effectively. The enhancements ensure that privileged operations are conducted through secure helpers, adhering to limited command sets, and migration processes validated by Ed25519 signatures.

Affected Version(s)

black_debian_images 1.2.0 < 1.6.0

References

https://cert.pl/en/posts/2026/10/CVE-2026-77052
third-party-advisory
https://boneio.eu/en/docs/black
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mateusz WĹ‚odarczak (s3ga)
.