# CVE-2026-77060: boneIO black_debian_images Mosquitto password file world-readable

Source: https://junglewise.ai/threats/cve-2026-77060-boneio-black-debian-images-stores-the-mosquitto-mqtt-broker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-77060 · Severity: info · Published 2026-10-26

boneIO Black is a home automation controller that manages lights, blinds, heating, and other connected devices through a web interface and MQTT protocol. The Mosquitto MQTT broker's password file is stored with world-readable permissions on the device, allowing any local user to read password hashes for all MQTT accounts and conduct offline dictionary attacks to compromise the broker and connected systems.

Technologies: [boneIO Black Debian Images](https://junglewise.ai/threats/technologies/black-debian-images). Vendors: [boneIO](https://junglewise.ai/threats/vendors/boneio).

## Quick answers

**Is CVE-2026-77060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77060 being exploited in the wild.

**How severe is CVE-2026-77060?** Informational severity, published 26 October 2026.

**Which products and versions are affected?** boneIO Black Debian Images 1.2.0 to 1.6.0.

**Is there a fix for CVE-2026-77060?** Yes: fixed in 1.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77060 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-77060?** Check whether you run boneIO Black Debian Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.0

## Technical details

The vulnerability is an incorrect permission assignment (CWE-732) where the password file at /etc/mosquitto/passwd is readable by all users on the system. A local attacker can read the password hashes, perform offline dictionary attacks, and potentially gain credentials to the MQTT broker. This requires local access to the device and does not affect remote attackers. The issue was fixed in version 1.6.0 by restricting the file to be readable only by the service account.

## Affected products

- boneIO black_debian_images 1.2.0 to 1.6.0

## Timeline

- 2026-10-26: disclosed

## References

- [https://boneio.eu/en/docs/black](https://boneio.eu/en/docs/black)
- [https://cert.pl/en/posts/2026/10/CVE-2026-77052](https://cert.pl/en/posts/2026/10/CVE-2026-77052)

## Related threats

- [boneIO black_debian_images default MQTT broker credentials](https://junglewise.ai/threats/cve-2026-77056-boneio-black-debian-images-ships-with-a-mosquitto-mqtt-broker)
- [boneIO black_debian_images privilege escalation via sudoers and docker group](https://junglewise.ai/threats/cve-2026-77055-boneio-black-debian-images-gives-the-boneio-service-account)