Yarbo Robot Fleet CVE-2026-10557: Hard-Coded MQTT Credentials Expose 50,000+ Devices to Remote Takeover

Introduction

A single set of MQTT credentials, hard-coded into the Yarbo mobile app and shared across every user and every device on the planet, let anyone with a copy of the APK monitor and command an entire fleet of autonomous yard robots. With over 50,000 Yarbo units deployed across 30+ countries, the exposure covered lawn mowers, snow blowers, and blowers. These are machines with spinning blades and significant physical force, and a remote attacker could set them in motion.

Yarbo Inc. is a robotics company, founded in 2015, that manufactures modular autonomous yard care robots. It launched as Snowbot, rebranded in 2022, and has since expanded into lawn mowing, leaf blowing, and trimming. Yarbo reports more than 10,000 users globally, and its products have won the Red Dot Design Award and CES Innovation Awards. That puts it among a growing class of consumer IoT companies where software security and physical safety meet directly.

CVE-2026-10557, disclosed in CISA Industrial Control Systems Advisory ICSA-26-162-01 on June 11, 2026, carries a CVSS v3.1 score of 9.8 (Critical) and a CVSS v4.0 score of 9.3 (Critical). Markus Lassfolk of Truesec reported the vulnerability.

Technical information

Root cause: CWE-798 (Use of Hard-coded Credentials)

The Yarbo Android and iOS mobile apps stored MQTT broker credentials as plaintext string constants in the application binary. There were no per-user tokens and no dynamically provisioned secrets, just a single username/password pair, identical in every installation of the app worldwide. Any user, or any attacker, who decompiled the APK with freely available tools like apktool or jadx could extract them in minutes.

Once extracted, the credentials authenticated the holder to Yarbo's cloud MQTT brokers, which are the central communication backbone for the entire robot fleet. The brokers carry real-time telemetry (location, operational status, sensor readings, device serial numbers) and accept command messages that control physical robot behavior.

The compounding factor: CVE-2026-7368 (Missing Authorization)

CVE-2026-10557 is compounded by CVE-2026-7368 (CWE-862, CVSS v3.1: 8.1, CVSS v4.0: 8.6), which describes the complete absence of per-device or per-user authorization on the cloud MQTT broker. Together, the two vulnerabilities form a single exploitation chain:

The hard-coded credentials provide the initial access, and the missing authorization means that access spans the entire fleet instead of a single device or user.

Attack flow

The exploitation chain has four steps, and none of them require specialized tooling or advanced expertise:

1. Credential extraction. The attacker gets the Yarbo Android APK from any app store mirror or directly from a device. Standard decompilation tools reveal the MQTT broker username and password, embedded in the binary as plaintext strings with no obfuscation or encryption.
2. Broker authentication. Using any standard MQTT client, the attacker connects to the Yarbo cloud MQTT broker with the extracted credentials. Because the credentials are universal, the same values work regardless of which user account or device installed the app.
3. Fleet-wide telemetry subscription. With an authenticated MQTT session and no broker-side authorization checks (CVE-2026-7368), the attacker issues a wildcard subscription (e.g., yarbo/# or an equivalent topic pattern) and receives real-time telemetry from every connected Yarbo robot in the world. The telemetry includes GPS location data, operational status, sensor readings, and device serial numbers, which the next step depends on.
4. Command injection. The attacker takes a target robot's serial number from the telemetry stream and publishes MQTT messages to that robot's command topic. The serial number is the only identifier needed to target a specific robot. From there, the attacker can remotely start or stop mowing cycles, change direction, activate blades, or trigger other mechanical actions.

Severity assessment

The CVSS v3.1 vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is the worst-case profile. The attack is network accessible, has low complexity, needs no privileges and no user interaction, and has high impact on confidentiality, integrity, and availability. The CVSS v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N reaches the same picture under the newer scoring methodology.

Physical safety implications

Security researcher Andreas Makris independently demonstrated that remote hijacking of Yarbo robots translates directly into physical harm. In May 2026 he published findings showing that attackers could harvest WiFi passwords from Yarbo devices, access robot cameras, and take full operational control. To prove the physical danger was not theoretical, Makris commanded a Yarbo lawn mower to run him over. The Verge later reported on Yarbo's promise to address the vulnerabilities.

Patch information

The fix for CVE-2026-10557 has two parts, one client-side and one server-side, because the flaw sits in both the app and the broker.

Client-side fix: mobile app v3.17.4

Yarbo released mobile app version 3.17.4 for both Android and iOS. The CVE.org record marks all versions before 3.17.4 as affected (affected from 0 before 3.17.4), which makes 3.17.4 the minimum safe version. The update removes the shared, hard-coded MQTT credentials from the application binary entirely. In earlier versions those credentials were identical for all users and all devices, so anyone who decompiled the APK or inspected the iOS bundle could extract them. New installations and updated apps no longer carry the universal key to Yarbo's MQTT brokers.

The app update does not fix the whole problem on its own. Removing the embedded credential stops new extractions from the app, but if someone had already extracted the credentials from an older version, the server-side infrastructure also needed to stop honoring them.

Server-side fix: May 2026 cloud update

In May 2026, Yarbo deployed a server-side update to its cloud MQTT infrastructure that enforces broker-level authorization. According to CISA advisory ICSA-26-162-01, the update required no user action and was applied automatically to the cloud backend. The changes include tighter MQTT topic permissions that remove fleet-level shared access, a narrower scope for each credential so that wildcard subscriptions across the entire global fleet no longer work, and stricter boundaries around command topics.

Yarbo's own security update page, written by co-founder Kenneth Kohlmann, gives more detail on the server-side work. It describes replacing the old shared-password model with independent device-level credentials delivered via OTA updates, building a credential management service that derives device passwords dynamically from device identity instead of hard-coding them, and adding audit logging for operational access. The page lists several items as already completed, including resetting device root passwords and closing unauthenticated endpoints. Others, such as per-device credential rotation and a full audit trail, were still in progress at the time of publication.

Both patches are essential. The app update fixes the credential supply problem, since the binary no longer holds the secret. The broker update fixes the credential trust problem, because even a previously valid credential can no longer roam the entire fleet. Users must update their Yarbo app to 3.17.4 or later to be fully remediated on the client side. The server-side protections take effect regardless of user action.

Affected systems and versions

The following components are affected:

• Yarbo Android Mobile Application: All versions prior to 3.17.4
• Yarbo iOS Mobile Application: All versions prior to 3.17.4
• Yarbo Cloud MQTT Infrastructure: All versions prior to the May 2026 server-side update (CVE-2026-7368)

The vulnerability affects the entire deployed base of Yarbo robots that communicate through the cloud MQTT infrastructure, which Yarbo reports as over 50,000 units across 30+ countries. Every Yarbo product line that uses the mobile app for control is affected, including the Yarbo Snow Blower, Yarbo Lawn Mower, Yarbo Lawn Mower Pro, Yarbo Blower, and Trimmer Package.

Vendor security history

Yarbo's 2026 disclosure cycle shows a pattern of systemic security weaknesses. Three independent research groups disclosed four CVEs within about two months:

The backdoor AHA! found in CVE-2026-7413 is hard to explain as a simple coding oversight. A persistent, undocumented backdoor in production firmware implies either a deliberate design decision (e.g., a debug or diagnostic backdoor left in production) or a complete absence of code review processes.

Separately, Andreas Makris disclosed a distinct set of vulnerabilities in May 2026 covering WiFi password harvesting, camera access, and full remote hijacking of Yarbo robots. Yarbo responded publicly on May 8, 2026, with a detailed pledge to fix the issues, as reported by The Verge.

After the May 2026 disclosures, Yarbo created a dedicated Security Center on its website with a vulnerability disclosure policy and a contact point. The Security Center does not mention any third-party security audits, penetration testing programs, or security certifications, all of which are standard practice for IoT device manufacturers that make safety-critical products.

The findings span the mobile application, the cloud infrastructure, and the device firmware, and multiple independent researchers found them in a short window. That suggests Yarbo's product development has lacked a structured security development lifecycle (SDL). The released patches address the immediate exposure, but without fundamental changes to the development process, further vulnerabilities in this expanding product line remain likely.

References

• CISA Advisory ICSA-26-162-01: Yarbo Android/iOS Mobile Application and Cloud Infrastructure
• NVD: CVE-2026-10557
• CVE Record: CVE-2026-10557
• CISA CSAF Advisory File (JSON)
• CISA CSAF GitHub Repository
• WindowsForum: Hard-Coded MQTT Secrets and Weak Authorization Risk Fleet Control
• Yarbo Security Update Regarding Remote Diagnostic Systems
• Yarbo Security Center
• Malwarebytes: Yarbo Responds to Robot Flaws That Could Mow Down Their Owners
• The Verge: Yarbo's Promise to Fix the Robot Mower That Ran Over a Researcher
• Yarbo Forum: Security Breach / Backdoor Into All Yarbo Cores
• AHA!: CVE-2026-7415
• GitHub Advisory: GHSA-5jxr-5v22-49gf
• Yarbo About Us