CVE-2026-7368: Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization

Synopsis

Missing authorization in the Yarbo Android/iOS mobile application and Yarbo Cloud MQTT infrastructure allows any authenticated client to subscribe to wildcard MQTT topics covering every robot in the global fleet and publish commands to any individual robot using only its serial number. The vulnerability is reachable over the network and requires only low-privilege credentials, meaning a single compromised account is sufficient to gain fleet-wide control without any per-device access check. Successful exploitation enables an attacker to read telemetry from and issue commands to any Yarbo robot globally, and a patched-image rebuild at version 3.17.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Yarbo Cloud MQTT broker over the network; the service is internet-exposed by design for remote robot management.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker needs only a single set of valid credentials, including the previously hard-coded shared credentials or any one legitimately issued per-user credential.

• Victim interactionNot required

  No user action is needed; the attacker interacts directly with the MQTT broker without involving any other user.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions or special environmental factors are required, and robot serial numbers needed to target specific devices are disclosed in the telemetry stream.

Blast Radius

• Reads live telemetry from every robot in the global Yarbo fleet by subscribing to wildcard MQTT topics, exposing location, status, and operational data for all devices.
• Issues arbitrary commands to any individual robot using only its serial number, enabling unauthorized control of physical robotic equipment across all customer deployments.
• A single compromised low-privilege credential exposes the entire fleet, meaning account takeover of any one user account removes all device-level access boundaries.