CVE-2026-10557Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-06-12); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Daily CyberSecurity@the_yellow_fall131d
Disclosure
A critical Yarbo robot vulnerability lets attackers extract hard-coded MQTT credentials and command the global fleet via CVE-2026-10557. #Yarbo #CVE202610557 #MQTT #IoTSecurity https://securityonline.info/yarbo-robot-vulnerability
Post summary
The post announces a critical CVE-2026-10557 in Yarbo robots that allows attackers to pull embedded MQTT credentials and remotely control the fleet, but provides no PoC, exploit, or patch information.
02031308
12.8K followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs135d
Disclosure
CVE-2026-10557 (Yarbo Android/iOS apps) is a critical hard-coded credentials flaw. Attackers could access fleet-wide robot telemetry and potentially publish unauthorised device commands. See full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-12/TIER_2_CVE-2026-10557.md #IoTSecurity #DPI #CloudSecurity #Robotics
Post summary
The tweet announces CVE-2026-10557 as a critical hard‑coded credential vulnerability affecting Yarbo Android/iOS apps, detailing its potential impact but providing no exploit, patch, or active exploitation evidence.
0000046
52 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-10557 Hard-Coded MQTT Broker Credentials in Yarbo Mobile Applications Enabling Unauthorized Fleet Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10557
Post summary
A new vulnerability (CVE-2026-10557) involving hard‑coded MQTT broker credentials in Yarbo mobile applications was reported, exposing unauthorized fleet access, but no PoC, exploit, or patch information was disclosed.
0000059
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-10557

Daily CyberSecurity@the_yellow_fallDisclosure

The post announces a critical CVE-2026-10557 in Yarbo robots that allows attackers to pull embedded MQTT credentials and remotely control the fleet, but provides no PoC, exploit, or patch information.

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObsDisclosure

The tweet announces CVE-2026-10557 as a critical hard‑coded credential vulnerability affecting Yarbo Android/iOS apps, detailing its potential impact but providing no exploit, patch, or active exploitation evidence.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new vulnerability (CVE-2026-10557) involving hard‑coded MQTT broker credentials in Yarbo mobile applications was reported, exposing unauthorized fleet access, but no PoC, exploit, or patch information was disclosed.