CVE-2026-7368
High
Description
The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.
SeverityHigh
CVSS8.1
Exploit probability—
ProductYarbo Android/IOS mobile application
PublishedJun 12, 2026
First seenJun 12, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- Yarbo Yarbo Android/IOS mobile application3.17.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Yarbo Yarbo Android/IOS mobile application | v < 3.17.4 | 3.17.4 |
| Yarbo Yarbo Cloud MQTT infrastructure | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.