Is CVE-2026-7368 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7368 being exploited in the wild.

How severe is CVE-2026-7368?

High severity, with a CVSS score of 8.1, published 12 June 2026.

Which products and versions are affected?

Yarbo Cloud MQTT infrastructure All versions prior to May 2026 update.

Is there a fix for CVE-2026-7368?

A patch was published on 2026-05: Server-side broker authorization enforced in May 2026 update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7368 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-7368?

Check whether you run Yarbo Cloud MQTT infrastructure, Yarbo Android Application or Yarbo iOS Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7368: Yarbo Cloud MQTT infrastructure missing authorization

CVE-2026-7368 · Severity: high · CVSS 8.1 · Published 2026-06-12

Yarbo, a manufacturer of multi-purpose yard robots, has a security flaw in its cloud infrastructure that fails to properly separate user accounts and devices. An attacker with any valid set of credentials can view real-time location and status data for every Yarbo robot globally and send unauthorized commands to them. This could lead to the hijacking of robot operations, unauthorized surveillance, or a complete loss of privacy for all customers.

Vendors: Yarbo.

Quick answers

Is CVE-2026-7368 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7368 being exploited in the wild.
How severe is CVE-2026-7368?: High severity, with a CVSS score of 8.1, published 12 June 2026.
Which products and versions are affected?: Yarbo Cloud MQTT infrastructure All versions prior to May 2026 update.
Is there a fix for CVE-2026-7368?: A patch was published on 2026-05: Server-side broker authorization enforced in May 2026 update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7368 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-7368?: Check whether you run Yarbo Cloud MQTT infrastructure, Yarbo Android Application or Yarbo iOS Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) within the Yarbo Cloud MQTT infrastructure. While the system requires authentication, it does not implement granular access control to ensure users can only interact with their own devices. An attacker with valid credentials—including those obtained via hard-coded strings in older app versions or legitimate user accounts—can subscribe to wildcard MQTT topics to receive telemetry for all robots. By obtaining a robot's serial number from this telemetry stream, the attacker can then publish messages to that specific robot's command topic. This allows for fleet-wide unauthorized monitoring and control. The issue is addressed via server-side updates to the MQTT broker and by updating the mobile application to version 3.17.4 or later.

Affected products

Yarbo Cloud MQTT infrastructure All versions prior to May 2026 update
Yarbo Yarbo Android/iOS Mobile Application < 3.17.4

Timeline

2026-06-11: advisory: CISA published advisory ICSA-26-162-01
2026-06-12: disclosed: NVD published CVE-2026-7368
2026-05: patched: Server-side broker authorization enforced in May 2026 update

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.