Quick answers
- Is CVE-2026-77055 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77055 being exploited in the wild.
- How severe is CVE-2026-77055?
- Informational severity, published 26 October 2026.
- Which products and versions are affected?
- boneIO Black Debian Images 1.2.0 to 1.6.0.
- Is there a fix for CVE-2026-77055?
- Yes: fixed in 1.6.0. Until then: Devices already deployed have both sudoers rule and docker group membership removed by migrations shipped with boneio 1.6.0 and applied on first start after upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77055 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-77055?
- Check whether you run boneIO Black Debian Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.6.0
Devices already deployed have both sudoers rule and docker group membership removed by migrations shipped with boneio 1.6.0 and applied on first start after upgrade.
Technical details
A privilege escalation vulnerability (CWE-266) in boneIO black_debian_images versions 1.2.0 through 1.6.0 stems from excessive privileges assigned to the boneio service account: full passwordless sudo access and membership in the docker group. An attacker with local access to the compromised boneio account can exploit these privileges to escalate to root. The fix removes sudoers rules and docker group membership during image sealing and via migrations applied on first boot after upgrade.
Affected products
- boneIO black_debian_images 1.2.0 to 1.6.0
Timeline
- 2026-10-26: disclosed
- 2026-10-26: patched: fixed in version 1.6.0