CVE-2026-7368

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Yarbo	Yarbo Android/IOS mobile application	< 3.17.4
Yarbo	Yarbo Cloud MQTT infrastructure	All

References

Timeline

Published: Jun 12, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-736808.8Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only CVE-2026-736838.1Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captur CVE-2026-736938.8FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with u CVE-2026-736947.2FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that st CVE-2026-736958.8Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attacke CVE-2026-736968.1Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flo CVE-2026-736978.8Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_e CVE-2026-736987.2FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by su CVE-2026-736997.2FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by explo CVE-2026-737009.0A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator CVE-2026-737019.0An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could CVE-2026-737028.8A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticat