Quick answers
- Is CVE-2026-77054 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77054 being exploited in the wild.
- How severe is CVE-2026-77054?
- Informational severity, published 26 October 2026.
- Which products and versions are affected?
- boneIO Black before 1.6.0.
- Is there a fix for CVE-2026-77054?
- Yes: fixed in 1.6.0. Until then: Enable authentication and restrict network access to the controller's web panel and API to trusted networks only, limiting exposure of the /api/config endpoint. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77054 attacked?
- It is attacked over the network or from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-77054?
- Check whether you run boneIO Black at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.6.0
Enable authentication and restrict network access to the controller's web panel and API to trusted networks only, limiting exposure of the /api/config endpoint.
Technical details
The application stores passwords in cleartext and returns them via the GET /api/config API endpoint. An authenticated attacker can directly access the endpoint to retrieve MQTT broker and web panel passwords; however, due to CVE-2026-77053, authentication defaults to disabled, allowing unauthenticated network access to the same endpoint from the local network. The vulnerability was fixed in version 1.6.0 by storing web panel passwords as salted scrypt hashes and moving sensitive values out of the API response.
Affected products
- boneIO boneIO Black before 1.6.0
Timeline
- 2026-10-26: disclosed