CVE-2026-7368: Yarbo Cloud Authorization Bypass – Fleet-Wide Robot Control

Technical summary

CVE-2026-7368 describes an authorization bypass in the Yarbo cloud backend. The vulnerability stems from absent per-device and per-user authorization enforcement on MQTT topics. Authenticated clients can subscribe to wildcard topics to observe all robot telemetry across the global fleet, and can publish commands to any robot's command topic using only the robot's serial number extracted from the telemetry stream itself. The vulnerability persists even after removal of hard-coded credentials because legitimate user credentials lack proper scope binding—a single compromised credential grants unrestricted fleet-wide access. This is a CWE-862 (Missing Authorization) issue rated CVSS 8.1 (HIGH).

Business impact

Organizations deploying Yarbo robots face significant operational and security risk. A compromised user account—whether through phishing, credential stuffing, or insider threat—grants an attacker ability to monitor robot operations globally and issue unauthorized commands to any device in the fleet. This could lead to disruption of robotic workflows, unauthorized data collection from robot sensors, physical disruption or safety hazards (depending on robot function), and reputational damage. For enterprises relying on Yarbo for production or critical tasks, this vulnerability could affect multiple sites or operations simultaneously.

Affected systems

The Yarbo cloud platform and all robots connected to it are affected. The vulnerability exists in the cloud authorization layer, not in client firmware, so it impacts all robot deployments regardless of Yarbo app version. Organizations should assume their entire Yarbo fleet is exposed if any user credential—particularly shared or legacy hard-coded credentials—has been disclosed, lost, or compromised.

Exploitability

Exploitability is high. An attacker requires only a valid cloud credential (low barrier—shared credentials may already be in circulation, or a single user credential can be compromised through standard social engineering). No special network access, client-side exploits, or user interaction is required. Discovery of target robot serial numbers is passive and trivial, as they are disclosed in unencrypted telemetry. An attacker can begin issuing commands immediately upon authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) reflects this: network-accessible, low attack complexity, and minimal privilege requirements.

Remediation

Remediation requires Yarbo to implement strict per-device and per-user authorization controls in the cloud platform. Each authenticated user credential must be scoped to specific robots or device groups, not the entire fleet. Topic subscriptions should be restricted by device assignment, and command publication should verify that the requesting user has explicit authorization for the target robot. Additionally, hard-coded credentials must be rotated immediately, and clients should be forced to use per-user authentication. Organizations should request a security advisory from Yarbo specifying patch availability, expected timeline, and interim mitigations.

Patch guidance

Contact Yarbo for an official security patch or update timeline. Do not rely on app updates alone; the vulnerability exists in the cloud backend and requires server-side changes. Until a patch is available, implement interim controls: rotate all shared credentials, enforce strong unique passwords for each user, audit and restrict which users have Yarbo cloud access, monitor cloud activity logs for unauthorized subscriptions or commands, and consider disabling Yarbo cloud integration if the robots can operate in local/offline mode. Verify any patch against the vendor's official security advisory before deployment.

Detection guidance

Monitor Yarbo cloud logs for suspicious patterns: (1) authentication from unusual IP addresses or geographic locations, (2) users subscribing to wildcard or global topics, (3) command publication to robots outside the user's normally assigned fleet, (4) high-volume telemetry subscriptions or rapid command sequences from a single credential. Enable audit logging on the Yarbo cloud platform if available. Examine network traffic for unexpected MQTT topic subscriptions. Cross-reference user activity logs with assigned robot groups to identify out-of-scope access. Watch for credential reuse across multiple user accounts or unusual login timing.

Why prioritize this

This vulnerability merits immediate priority due to the combination of high CVSS score (8.1), ease of exploitation (network-accessible, low complexity, minimal privilege), broad impact (fleet-wide access with a single credential), and lack of user interaction or client-side complexity. The fact that serial numbers are passively disclosed in telemetry eliminates the discovery barrier. Organizations with production Yarbo deployments should prioritize patch testing and interim mitigations without delay.

Risk score, explained

CVSS 8.1 (HIGH) reflects: (1) Network accessibility (AV:N)—no proximity or special network position required, (2) Low attack complexity (AC:L)—no special conditions or timing, (3) Low privilege requirement (PR:L)—any authenticated user can exploit, (4) High confidentiality impact (C:H)—unrestricted access to telemetry and robot state across the fleet, (5) High integrity impact (I:H)—ability to modify robot commands and behavior, (6) No availability impact (A:N)—the attack does not directly DoS the platform. The score does not account for business context (e.g., robot function, criticality), which should inform internal risk assessment.

Frequently asked questions