# CVE-2026-77058: boneIO Black Cross-Site Request Forgery on state-changing API endpoints

Source: https://junglewise.ai/threats/cve-2026-77058-boneio-black-is-vulnerable-to-cross-site-request-forgery-csrf-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-77058 · Severity: info · Published 2026-10-26

boneIO Black is a home automation controller that manages electrical circuits, gates, and blinds through web-based control. An attacker can craft a malicious webpage that forces unauthorized state changes—rebooting the controller, toggling circuits, controlling gates and blinds, or shutting it down—when a user on the same network visits it. This loss of device availability and integrity is especially critical because authentication is disabled by default, allowing any network user to be exploited.

Technologies: [boneIO Black](https://junglewise.ai/threats/technologies/boneio-black). Vendors: [boneIO](https://junglewise.ai/threats/vendors/boneio).

## Quick answers

**Is CVE-2026-77058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77058 being exploited in the wild.

**How severe is CVE-2026-77058?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** boneIO Black before 1.6.0.

**Is there a fix for CVE-2026-77058?** Yes: fixed in 1.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77058 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-77058?** Check whether you run boneIO Black at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.0

## Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) affecting all state-changing API endpoints in boneIO Black due to missing CSRF tokens and no validation of Origin or Referer headers. An unauthenticated remote attacker on the same internal network can send cross-origin requests that perform arbitrary actions without user knowledge. The issue is compounded by CVE-2026-77053, where authentication is disabled by default, making exploitation trivial for any network-adjacent attacker.

## Affected products

- boneIO Black before 1.6.0

## Timeline

- 2026-10-26: disclosed

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://boneio.eu/en/docs/black](https://boneio.eu/en/docs/black)

## Related threats

- [boneIO Black web interface clickjacking vulnerability](https://junglewise.ai/threats/cve-2026-77062-the-boneio-black-web-interface-lacks-proper-clickjacking)
- [boneIO Black authentication bypass on API endpoints](https://junglewise.ai/threats/cve-2026-77061-boneio-black-directly-excludes-several-api-endpoints-from-the)
- [boneIO Black TOCTOU race condition in timezone_sudoers](https://junglewise.ai/threats/cve-2026-77059-boneio-black-contains-a-toctou-race-condition-in-the-create)
- [boneIO Black brute-force attacks on web and SSH](https://junglewise.ai/threats/cve-2026-77057-boneio-black-does-not-limit-authentication-attempts-on-its-web)
- [boneIO Black cleartext password storage in config endpoint](https://junglewise.ai/threats/cve-2026-77054-boneio-black-stores-passwords-including-the-mqtt-broker-and-web)