CVE-2026-10557: Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

Synopsis

Hard-coded credential vulnerability in the Yarbo Android and iOS mobile applications allows any unauthenticated attacker with network access to extract identical MQTT broker credentials from the application binary and use them against Yarbo's cloud infrastructure. The credentials are embedded in all app versions below 3.17.4 and are trivially recoverable via APK decompilation, requiring no special skill or account. Successful exploitation gives an attacker the ability to read real-time telemetry from any Yarbo robot in the global fleet and send commands to any device using only its serial number. A patched-image rebuild at version 3.17.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach Yarbo's cloud MQTT brokers over the internet; the vulnerable service is network-exposed and reachable from any internet-connected host.

• AuthenticationNot required

  No account or credential is needed beyond what is already embedded in the application binary; the hard-coded credentials themselves supply full broker access.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and requires no action from any Yarbo user or device owner.

• Attack complexityDetail

  The exploit is reliable and condition-free; extracting credentials requires only standard APK decompilation tooling and no timing constraints or environmental dependencies.

Blast Radius

• Reads real-time telemetry from every Yarbo robot in the global fleet by subscribing to wildcard MQTT topics, exposing GPS location, operational state, and sensor data for all devices.
• Publishes arbitrary commands to any individual robot's command topic using only its serial number, enabling unauthorized control of physical robot behavior.
• Tampers with command streams in a way that persists until the device reconnects or receives a corrective command, disrupting normal operation across any targeted subset of the fleet.
• Enumerates active serial numbers passively from the telemetry stream, building a target list of devices without any interaction with device owners.