Security advisories
Published boneIO Black vulnerabilities, what they affect and what to do on your controller
Every boneIO Black vulnerability that has a CVE ID is published here: which versions it affects, which version fixes it, and whether you have to do anything beyond updating. Newest first.
Handling reports and publishing fixed vulnerabilities is part of adapting boneIO Black to the requirements of the EU Cyber Resilience Act (CRA). The rules are in the security policy.
October 2026 — review of version 1.5.0 (CERT Polska)
An independent security review of boneIO Black 1.5.0 was disclosed in coordination with CERT Polska on 26 October 2026: CERT Polska notice. All vulnerabilities are fixed in 1.6.0. Thanks to Mateusz Włodarczak (s3ga) for the report.
What to do
- Update the application to the latest 1.6.x. From 1.5, go to 1.5.6 first, then follow the checklist.
- Create an administrator account in the wizard that appears after the update. Until then the controller refuses API requests.
- Change the MQTT broker password if the controller was updated rather than freshly flashed. The update deliberately leaves it alone so the connection to Home Assistant does not break. The panel reports it under Settings → Access → Security, and Fix takes you to the change. Then enter the new password in Home Assistant.
- Change the SSH password if it is still the factory one — SSH login password.
- Controllers older than 1.2.0 (Debian 10) cannot be updated. Flash a 1.6 system image — upgrading to Debian 13.
Vulnerabilities
| CVE | What it was | Affected | Beyond updating |
|---|---|---|---|
| CVE-2026-77052 | Node-RED at /nodered/ without sign-in — deploying flows that run system commands | 1.3.0 – before 1.6.0 | — |
| CVE-2026-77053 | Panel API without authentication by default | 1.0.0 – before 1.6.0 | create an administrator account |
| CVE-2026-77054 | GET /api/config returned passwords (MQTT, panel) | 1.2.0 – before 1.6.0 | change the MQTT password |
| CVE-2026-77055 | boneio account with passwordless sudo and in the docker group (system image) | 1.2.0 – before 1.6.0 | — |
| CVE-2026-77056 | Same published MQTT broker password on every device (system image) | 1.2.0 – before 1.6.0 | change the MQTT password |
| CVE-2026-77057 | No limit on sign-in attempts in the panel and SSH, no minimum password length | 1.2.0 – before 1.6.0 | — |
| CVE-2026-77058 | CSRF — another site could send commands to the controller | 1.2.0 – before 1.6.0 | — |
| CVE-2026-77059 | Race when installing the time zone sudoers rule | 1.3.0 – before 1.6.0 | — |
| CVE-2026-77060 | Mosquitto password file readable by every local account (system image) | 1.2.0 – before 1.6.0 | — |
| CVE-2026-77061 | Some API endpoints reachable without sign-in (logs, serial number, file list) | 1.2.0 – before 1.6.0 | — |
| CVE-2026-77062 | Clickjacking — the panel could be framed by another site | 1.2.0 – before 1.6.0 | — |
The system image fixes (77055, 77056, 77060) reach an updated controller through signed system migrations — except the MQTT password, which you change yourself. What exactly changed in 1.6.0: release notes.
Reporting a vulnerability
Please do not open a public issue. Use
private reporting on GitHub
or email security@boneio.eu with SECURITY in the subject. We acknowledge
within 5 working days. You can also report through
CERT Polska.