dbcve.org
Hard-coded CredentialsWeakness · CWE-798

CVE-2026-10557

CRITICAL · 9.8 CVSS v3.1 Published 2026-06-12
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials embedded in the application binaries. These identical credentials are extractable via APK decompilation and provide unauthorized access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. The credentials enable both wildcard subscription to all robot telemetry topics and command publishing to any robot using only its serial number.

MitigationRemove hard-coded credentials from the application binaries and implement proper user/device-specific authentication (e.g., OAuth tokens, certificate-based authentication) for MQTT connections. Rotate the compromised credentials immediately and push updated application versions to all users.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the installed Yarbo app version
    On Android, go to Settings > Apps > Yarbo > App info to see version. On iOS, go to Settings > Yarbo to view version number.
    Affected if Any version of the Yarbo app is installed - the vulnerability exists in the binary itself regardless of version
  2. Extract and inspect the application binary
    For Android: download the APK (via ADB pull or APK download site). Use unzip to extract, then use strings command or a hex editor on classes.dex or lib files to search for MQTT-related patterns.
    Affected if Hardcoded MQTT broker URLs, usernames, or passwords are found in the binary strings
  3. Search for hardcoded MQTT credentials
    Run 'strings' on the extracted binary files (e.g., strings classes.dex | grep -i mqtt) and look for patterns like broker addresses, ports, usernames, and password strings.
    Affected if Static MQTT usernames/passwords or broker endpoints are embedded in plain text in the binary
  4. Check for hardcoded authentication tokens
    Search binary for static credential patterns: look for long alphanumeric strings that could be passwords, API keys, or tokens used for MQTT authentication.
    Affected if The binary contains static credentials that would be identical across all installations
  5. Verify MQTT connection configuration
    Examine any configuration files or hardcoded connection strings found in the binary that specify the MQTT broker address and authentication parameters.
    Affected if The application connects to an MQTT broker using embedded credentials rather than dynamic authentication

If the Yarbo mobile application is installed and its binary contains hardcoded MQTT broker credentials, the environment is affected by this vulnerability.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Remove hard-coded credentials from the application binaries and implement proper user/device-specific authentication (e.g., OAuth tokens, certificate-based authentication) for MQTT connections. Rotate the compromised credentials immediately and push updated application versions to all users.

Have this fixed Scoped from the published advisory
  • Consultation6.0 h
  • Implementation20.0 h
  • Testing10.0 h
  • Review / QA6.0 h
42.0 hours of engineering $7,380
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,808.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-10557 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-10557 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data