Quick answers
- Is CVE-2026-7415 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7415 being exploited in the wild.
- How severe is CVE-2026-7415?
- Critical severity, with a CVSS score of 9.8, published 7 May 2026.
- Which products and versions are affected?
- Yarbo Lawn Mower Firmware 2.3.9; Yarbo Lawn Mower Pro Firmware 2.3.9.
- Is there a fix for CVE-2026-7415?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-7415 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-7415?
- Check whether you run Yarbo Lawn Mower, Yarbo Lawn Mower Firmware, Yarbo Lawn Mower Pro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The embedded MQTT broker in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write Access Control Lists (ACLs). This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), allows any host on the same network to connect to the broker. Once connected, an attacker can subscribe to sensitive telemetry topics to leak data or publish control messages to the robot to influence its behavior. The issue was identified through static analysis of the Android APK and a filesystem dump of the robot's firmware.
Affected products
- Yarbo Lawn Mower firmware 2.3.9
- Yarbo Lawn Mower Pro firmware 2.3.9
Timeline
- 2026-05-07: disclosed
- 2026-05-07: advisory