CVE-2026-7368 Overview
CVE-2026-7368 is a missing authorization vulnerability [CWE-862] in the Yarbo cloud platform. The cloud backend does not enforce per-device or per-user authorization on its MQTT topic structure. Any client holding valid credentials, whether shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering every robot in the fleet. The same client can publish to any robot's command topic using only the serial number, which is exposed in the telemetry stream. The issue was disclosed in CISA ICS Advisory ICSA-26-162-01.
Critical Impact
A single compromised credential grants fleet-wide read and command access to all Yarbo robots globally, even after the removal of hard-coded credentials from the mobile application.
Affected Products
- Yarbo cloud platform (MQTT broker and topic authorization layer)
- Yarbo robot fleet devices subscribing to the cloud broker
- Yarbo mobile application client credentials
Discovery Timeline
- 2026-06-12 - CVE-2026-7368 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-7368
Vulnerability Analysis
The Yarbo cloud uses an MQTT broker to relay telemetry and commands between robots and clients. Authorization on the broker is binary: any authenticated client receives full publish and subscribe rights across the topic namespace. The broker does not bind credentials to a specific device identifier, user account, or topic scope. Wildcard subscriptions such as those covering all robot serial numbers are accepted without filtering. Telemetry streams expose each robot's serial number, which is the only identifier required to address a command topic. An attacker who acquires any valid credential set can therefore enumerate the global fleet and issue commands to arbitrary devices.
Root Cause
The root cause is a missing access control check on MQTT topic operations [CWE-862]. The broker authenticates clients but never authorizes the topic each client may publish to or subscribe from. There is no mapping between credentials, the owning user, and the device serial numbers a client is allowed to address.
Attack Vector
Exploitation requires network reachability to the Yarbo MQTT endpoint and any valid credential pair. The attacker connects to the broker, subscribes to a wildcard topic to harvest serial numbers from live telemetry, then publishes crafted command payloads to a target robot's command topic. No additional privilege escalation or device-side interaction is required.
No public proof-of-concept code is available. Refer to the CISA ICS Advisory ICSA-26-162-01 for the authoritative technical description.
Detection Methods for CVE-2026-7368
Indicators of Compromise
- MQTT CONNECT events from unexpected source IP addresses or geographies using known fleet credentials.
- Subscriptions to wildcard topics (# or multi-level wildcards) covering more than one device serial number.
- PUBLISH operations to command topics for robot serial numbers not owned by the publishing account.
Detection Strategies
- Log every MQTT CONNECT, SUBSCRIBE, and PUBLISH event on the broker with client identifier, source IP, and topic filter.
- Correlate the serial numbers seen in command publishes against the account-to-device ownership table to flag mismatches.
- Alert on any client that subscribes to topic filters containing MQTT wildcards reserved for administrative use.
Monitoring Recommendations
- Monitor for credential reuse across distinct source IP ranges within short time windows.
- Track baseline publish rates per client and alert on sudden multi-device command bursts.
- Forward broker logs into a SIEM or data lake for retention and longitudinal analysis of fleet-wide access patterns.
How to Mitigate CVE-2026-7368
Immediate Actions Required
- Rotate all Yarbo cloud credentials, prioritizing any that were previously hard-coded in the mobile application.
- Restrict broker exposure by IP allowlisting or VPN where supported by the deployment.
- Audit existing MQTT sessions for wildcard subscriptions and terminate sessions that do not match a known device or user scope.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Consult the CISA ICS Advisory ICSA-26-162-01 and the CSAF advisory file for the latest vendor remediation status and firmware or cloud configuration updates.
Workarounds
- Issue per-user, per-device credentials and revoke any shared credentials still in circulation.
- Configure broker-side ACLs that bind each credential to topic filters scoped to the user's owned serial numbers only.
- Treat device serial numbers as sensitive and remove them from telemetry payloads accessible to other tenants.
- Apply rate limits on PUBLISH operations to command topics to slow fleet-wide abuse if a credential is compromised.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
