CVE-2026-10557: Yarbo App Information Disclosure Flaw

CVE-2026-10557 Overview

CVE-2026-10557 is a hard-coded credentials vulnerability [CWE-798] affecting the Yarbo Android and iOS mobile applications. The applications embed MQTT broker credentials that are identical across every user and every device in the global fleet. Attackers can extract these credentials by decompiling the publicly available APK. Once extracted, the credentials grant access to cloud MQTT brokers carrying real-time telemetry for the entire Yarbo robot fleet. An attacker can subscribe to all robot telemetry topics using wildcards and publish commands to any robot by referencing only its serial number. CISA published advisory ICSA-26-162-01 documenting the issue.

Critical Impact
Network-based attackers can read telemetry from and issue commands to any Yarbo robot worldwide using credentials extracted from the mobile application binary.

Affected Products

Yarbo Android application
Yarbo iOS application
Yarbo robot fleet connected to the cloud MQTT brokers

Discovery Timeline

2026-06-12 - CVE-2026-10557 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-10557

Vulnerability Analysis

The vulnerability stems from hard-coded MQTT broker credentials embedded in both the Android and iOS Yarbo application binaries. Message Queuing Telemetry Transport (MQTT) is a publish-subscribe protocol commonly used in IoT deployments to relay device telemetry and commands. In the Yarbo architecture, every robot and every mobile client authenticates to the broker using the same shared username and password. This design eliminates per-user and per-device authentication boundaries.

Because the credentials are static and identical across the global fleet, any party who extracts them obtains the same access level as the vendor's own infrastructure clients. The broker enforces no tenant isolation at the topic level. An attacker can subscribe to wildcard topics such as those covering all robot telemetry feeds and can publish to any individual robot's command topic by knowing or guessing the robot's serial number.

Root Cause

The root cause is the storage of shared authentication secrets inside distributed client binaries, classified as [CWE-798] Use of Hard-coded Credentials. The architecture treats the MQTT broker as a trusted backplane while exposing the trust anchor to every customer download.

Attack Vector

Exploitation requires only network access to the Yarbo MQTT broker and a copy of the mobile application. An attacker downloads the APK from a public source, decompiles it using standard tooling such as apktool or jadx, and locates the credential strings within the compiled code or resource files. The attacker then connects to the broker with any standard MQTT client, subscribes to wildcard telemetry topics to enumerate active robots and their serial numbers, and publishes crafted command payloads to control individual devices.

No user interaction, prior authentication, or privileged access is required. See the CISA ICS Advisory ICSA-26-162-01 for additional technical context.

Detection Methods for CVE-2026-10557

Indicators of Compromise

Unexpected MQTT CONNECT sessions to the Yarbo broker originating from IP ranges not associated with mobile carrier or residential networks consistent with normal customer traffic.
Wildcard SUBSCRIBE requests covering broad telemetry topic hierarchies rather than a single device's topics.
PUBLISH messages targeting robot command topics from sources that have not previously received telemetry for the same serial number.
Anomalous robot behavior such as unscheduled movement, configuration changes, or firmware-related commands appearing in device logs.

Detection Strategies

Inspect MQTT broker access logs for clients using the hard-coded credential pair from IPs outside expected geolocation patterns.
Apply rate-based detection on SUBSCRIBE operations to flag clients consuming traffic for many distinct serial numbers in a short window.
Correlate mobile application sessions with broker connections to identify orphan sessions that have no corresponding authenticated app login.

Monitoring Recommendations

Forward MQTT broker authentication and topic-access logs to a centralized SIEM for retention and correlation.
Establish baselines for per-device command publication rates and alert on deviations.
Monitor public code repositories and paste sites for leaked Yarbo credential strings.

How to Mitigate CVE-2026-10557

Immediate Actions Required

Restrict broker access at the network layer where possible, including IP allow-listing for known mobile carrier ranges or fronting the broker with an authenticated API gateway.
Rotate the shared MQTT credentials and invalidate the embedded values, accepting that older application versions will lose connectivity until updated.
Audit broker access logs for the period preceding disclosure to identify unauthorized subscriptions or command publications.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Refer to the CISA ICS Advisory ICSA-26-162-01 and the corresponding GitHub CSAF Document for vendor remediation status and updates.

Workarounds

Issue per-user or per-device MQTT credentials provisioned during account registration rather than embedded in the client binary.
Enforce topic-level Access Control Lists (ACLs) on the broker so that a credential can only subscribe and publish to topics matching its bound device identity.
Require Transport Layer Security (TLS) client certificates in addition to username and password authentication for broker connections.
Segment the production broker from any development or testing brokers to reduce blast radius if a credential is exposed.

bash

# Example Mosquitto broker ACL restricting a client to a single device topic
# /etc/mosquitto/acl.conf
user device-<serial>
topic readwrite robots/<serial>/telemetry
topic readwrite robots/<serial>/command