MEDIUM 6.8 NVD

CVE-2026-77060

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.

References

https://boneio.eu/en/docs/black
https://cert.pl/en/posts/2026/10/CVE-2026-77052

Published: 2026-10-26 · Source: NVD · Feed updated: 2026-10-26

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-10-26 via NVD.

vulnfeed aggregates 18200 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.