CVE-2026-77060

Vulnerability Description

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.

Related Weaknesses (CWE)

CWE-732

References

https://boneio.eu/en/docs/black
https://cert.pl/en/posts/2026/10/CVE-2026-77052

FAQ

What is CVE-2026-77060?

CVE-2026-77060 is a documented vulnerability. boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts an...

How severe is CVE-2026-77060?

CVSS scoring is not yet available for CVE-2026-77060. Check NVD for updates.

Is there a patch for CVE-2026-77060?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.