{"id":"CVE-2026-77060","published":"2026-10-26T15:16:43.930","lastModified":"2026-10-26T17:11:35.487","description":"boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.\n\nThis issue was fixed in version 1.6.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-732"],"vendors":[],"products":[],"references":[{"url":"https://boneio.eu/en/docs/black","tags":[]},{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-77052","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}