CVE-2026-7368Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-12); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7368

Full discourse2 posts

DFIR Lab@DFIR_Lab137d
Disclosure
🚨 HIGH SEVERITY: CVE-2026-7368 (CVSS 8.1) Yarbo cloud platform lacks device/user authorization. Any valid credential grants fleet-wide access to all robots globally. Attackers can subscribe to telemetry & send commands using only serial numbers. #CVE #Vulnerability #PatchNow https://t.co/MuNPnvjBVb
Post summary
The post announces CVE-2026-7368, describing its high-severity lack of authorization that could let attackers control all robots with any valid credentials, but it offers no PoC, exploit code, active exploitation evidence, or specific patch details.
0000039
44 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-7368 Insufficient Authorization in Yarbo Cloud Enables Unauthorized Robot Command Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7368
Post summary
The post announces CVE‑2026‑7368, an authorization bypass flaw in Yarbor Cloud that permits unauthorized robot command execution; no PoC, exploit, active exploitation, or patch information is provided.
0000033
4.0K followersView on X

Explore more

Back to dashboard