CVE-2026-7415

CRITICAL 9.8

Open MQTT orchestration without read/write ACLs in Yarbo robot firmware

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages directly to the robot without authentication or authorization of any kind.

CWE	CWE-306
Vendor	yarbo
Product	firmware
Published	May 7, 2026
Last Updated	May 7, 2026

Stay Ahead of the Next One

Get instant alerts for yarbo firmware

Be the first to know when new critical vulnerabilities affecting yarbo firmware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Yarbo / Firmware

0 ≤ 2.3.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Bin4ry/yarbo-nat-in-my-back-yard takeonme.org: https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000000111111111100111111111110000000000000000000000000000000000000000000000000000001001

Credits

Andreas Makris (aka Bin4ry) todb of AHA!