Local Users Can Access MQTT Passwords in boneIO's black_debian_images

CVE-2026-77060

What is CVE-2026-77060?

The black_debian_images by boneIO has a vulnerability where the Mosquitto MQTT broker password file is stored with permissions that allow local users to read its contents. This security oversight enables any local user to access encrypted password hashes for all MQTT accounts, potentially allowing them to launch offline dictionary attacks. To mitigate this risk, users are encouraged to upgrade to version 1.6.0 or later, where this issue has been addressed.

References