What’s Vulnerable › Vulnerabilities

CVE-2026-77061: Missing Authentication for Critical Function in boneIO

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-26
• Weakness: CWE-306

Description

boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.

Affected products

• boneIO: from 1.2.0 before 1.6.0 — fixed in 1.6.0

How to fix

Upgrade to a fixed version: boneIO 1.6.0. Check the vendor advisory for mitigations.

References

• https://boneio.eu/en/docs/black
• https://cert.pl/en/posts/2026/10/CVE-2026-77052

Get alerted when CVE-2026-77061 or the next vulnerability affects your stack