CVE-2026-77060
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd…
- Risk score
- 41/100
- CVSS
- 6.8 v4.0
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks. This issue was fixed in version 1.6.0.
Last activity 26 Oct 2026. Patch Forecast updates every hour.