CVE-2026-77055: Improper Privilege Assignment in boneIO

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-266

Description

boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.

Summary

CVE-2026-77055 is a critical (CVSS 9.3) improper privilege assignment flaw in boneIO black_debian_images: the boneio service account has full passwordless sudo and docker group membership, so a local attacker who compromises that account can escalate to root. Affected are boneIO black_debian_images releases before 1.6.0. It is not listed in CISA KEV and no active exploitation is reported. Upgrade to 1.6.0, which removes the sudoers rule and docker group membership when the image is sealed and applies migrations on first start; privileged operations then use restricted helpers with Ed25519-verified migrations.

تُعدّ CVE-2026-77055 ثغرة حرجة (CVSS 9.3) في تعيين الصلاحيات بشكل غير صحيح ضمن boneIO black_debian_images، إذ يمنح حساب خدمة boneio صلاحية sudo كاملة دون كلمة مرور وعضوية في مجموعة docker، ما يتيح لمهاجم محلي يخترق حساب boneio تصعيد صلاحياته إلى root. تتأثر إصدارات boneIO black_debian_images السابقة للإصدار 1.6.0. الثغرة غير مدرجة في CISA KEV ولا توجد تقارير عن استغلال نشط لها. الحل هو الترقية إلى الإصدار 1.6.0 الذي يزيل قاعدة sudoers وعضوية مجموعة docker عند إغلاق الصورة ويطبّق الترحيلات عند أول تشغيل، لتمرّ العمليات ذات الصلاحيات عبر أدوات مساعدة محدودة الأوامر مع تحقق من الترحيلات بتوقيعات Ed25519.

Affected products

boneIO black_debian_images: from 1.2.0 before 1.6.0 — fixed in 1.6.0

How to fix

Upgrade to a fixed version: boneIO black_debian_images 1.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-77055 or the next vulnerability affects your stack