What’s Vulnerable › Vulnerabilities

CVE-2026-7368: Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-12 · updated 2026-06-17
• Weakness: CWE-862

Description

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

Affected products

• Yarbo Android/IOS mobile application: before 3.17.4 — fixed in 3.17.4
• Yarbo Cloud MQTT infrastructure: all versions

How to fix

Upgrade to a fixed version: Yarbo Android/IOS mobile application 3.17.4. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01

Get alerted when CVE-2026-7368 or the next vulnerability affects your stack