# CVE-2026-10557: Yarbo Mobile App and Cloud hard-coded MQTT credentials

Source: https://junglewise.ai/threats/cve-2026-10557-yarbo-mobile-app-and-cloud-hard-coded-mqtt-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-10557 · Severity: critical · CVSS 9.8 · Published 2026-06-12

Yarbo produces autonomous yard robots, such as snowblowers and lawn mowers, managed via mobile apps. A security flaw was found where the mobile applications used the same hard-coded login credentials for every user and robot worldwide. An attacker could use these credentials to track the real-time location of any Yarbo robot and potentially send unauthorized movement or operational commands, posing a physical safety risk and a significant privacy breach.

Vendors: [Yarbo](https://junglewise.ai/threats/vendors/yarbo).

## Quick answers

**Is CVE-2026-10557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10557 being exploited in the wild.

**How severe is CVE-2026-10557?** Critical severity, with a CVSS score of 9.8, published 12 June 2026.

**Which products and versions are affected?** Yarbo Android mobile application < v3.17.4; Yarbo Cloud MQTT infrastructure All versions prior to May 2026 update; Yarbo iOS mobile application < v3.17.4.

**Is there a fix for CVE-2026-10557?** A patch was published on 2026-05-01: Server-side broker authorization enforcement and mobile app update 3.17.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10557 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10557?** Check whether you run Yarbo Android mobile application, Yarbo Cloud MQTT infrastructure or Yarbo iOS mobile application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Yarbo mobile applications (Android and iOS) utilize hard-coded MQTT broker credentials (CWE-798) that are shared across the entire product ecosystem. These credentials can be easily extracted by decompiling the application binary (APK/IPA). Once obtained, an attacker can connect to the Yarbo cloud MQTT infrastructure without further authentication. The vulnerability allows for wildcard subscriptions to telemetry topics, exposing real-time data for all robots globally. Furthermore, by using a robot's serial number (which is visible in the telemetry stream), an attacker can publish messages to a robot's command topic to remotely control its operations. A fix is available in mobile app version 3.17.4 and via server-side authorization updates deployed in May 2026.

## Affected products

- Yarbo Yarbo Android mobile application < v3.17.4
- Yarbo Yarbo iOS mobile application < v3.17.4
- Yarbo Cloud MQTT infrastructure All versions prior to May 2026 update

## Timeline

- 2026-06-11: advisory: Initial publication of ICSA-26-162-01 by CISA
- 2026-06-12: disclosed: CVE-2026-10557 published to NVD
- 2026-05-01: patched: Server-side broker authorization enforcement and mobile app update 3.17.4 released

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-01.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01)

## Related threats

- [Yarbo Cloud MQTT infrastructure missing authorization](https://junglewise.ai/threats/cve-2026-7368-yarbo-cloud-mqtt-infrastructure-missing-authorization)