# Yarbo robot fleet exposed via hardcoded MQTT credentials

Published: 2026-06-11 · Severity: critical · Sectors: infrastructure
Canonical: https://vorant.io/reports/07fcf2f3-c9d6-40da-88f6-11f9a52c5542/yarbo-robot-fleet-exposed-via-hardcoded-mqtt-credentials

> Hardcoded credentials in Yarbo's mobile apps allow attackers to access telemetry and send commands to the entire global robot fleet via cloud MQTT infrastructure.

CISA has disclosed two critical vulnerabilities in Yarbo's Android/iOS mobile applications and cloud MQTT infrastructure that could allow attackers to compromise the company's entire global robot fleet. The first vulnerability (CVE-2026-10557) involves hard-coded MQTT broker credentials embedded in the mobile application binaries that are identical across all users and devices. These credentials can be easily extracted through APK decompilation and provide access to real-time telemetry for all Yarbo robots worldwide, as well as the ability to publish commands to any robot using only its serial number.

The second vulnerability (CVE-2026-7368) stems from the lack of per-device or per-user authorization enforcement in the Yarbo cloud infrastructure. Even after the hard-coded credentials are removed, any client with valid credentials can subscribe to wildcard topics covering all robots globally and send commands to any device. This architectural flaw means that a single compromised credential could provide fleet-wide access without proper access controls.

Yarbo has released mobile app version 3.17.4 to address these issues, and server-side broker authorization will be automatically enforced with the May 2026 update. The vulnerabilities affect commercial facilities worldwide, with no known public exploitation reported to CISA at this time. Organizations using Yarbo robots should update their mobile applications immediately and follow standard ICS security practices including network isolation and minimizing internet exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-10557, CVE-2026-7368

## Detection guidance (public sample)

### String Extraction Search for Embedded MQTT or Broker Credentials

ATT&CK: T1552.001

Detects use of string-searching utilities (strings, grep, findstr) against mobile application package files (APK/IPA) or extracted binaries with keywords related to MQTT brokers, indicating an attempt to locate hard-coded credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: String Search for Hardcoded MQTT Credentials in Mobile App Files
id: 148309ee-f500-5b2c-85dd-b5bd5752d183
status: experimental
description: Detects command-line string extraction or grep-style searches targeting
  APK/IPA files or extracted mobile app resources for keywords associated with MQTT
  broker credentials (mqtt, broker, password, secret), suggestive of credential harvesting
  from mobile app binaries as seen in the Yarbo MQTT credential disclosure.
references:
- Yarbo MQTT hardcoded credentials disclosure (CVE-2026-10557)
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \strings.exe
    - \findstr.exe
    - \grep.exe
  selection_target:
    CommandLine|contains:
    - .apk
    - .ipa
  selection_keyword:
    CommandLine|contains:
    - mqtt
    - broker
    - password
    - secret
  condition: selection_tool and selection_target and selection_keyword
falsepositives:
- Mobile security testers or developers auditing their own applications for hardcoded
  secrets
level: medium
tags:
- attack.T1552.001
- attack.credential_access
author: Vorant
```

### MQTT Client Wildcard Topic Subscription Indicating Shared Credential Abuse

ATT&CK: T1078

Detects use of MQTT command-line clients (mosquitto_pub/mosquitto_sub or similar) subscribing to or publishing on broad wildcard topics, consistent with abuse of shared or hardcoded broker credentials to access or command an entire device fleet rather than a single authorized device. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MQTT Client Wildcard Topic Subscription or Publish
id: 1e22c67e-bf73-5d8f-8bf1-20d42438399e
status: experimental
description: Detects invocation of MQTT command-line clients (mosquitto_pub, mosquitto_sub,
  mqtt-cli) with wildcard topic filters (# or +) that subscribe to or publish on broad
  or global topic namespaces. This pattern is consistent with abuse of shared or hard-coded
  broker credentials to access or issue commands to an entire fleet of IoT/robot devices
  rather than a single authorized device, as described in the Yarbo MQTT fleet compromise
  disclosure.
references:
- Yarbo MQTT hardcoded credentials and missing authorization disclosure (CVE-2026-10557,
  CVE-2026-7368)
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \mosquitto_sub.exe
    - \mosquitto_pub.exe
    - \mqtt-cli.exe
  selection_wildcard:
    CommandLine|contains:
    - '-t #'
    - -t '#'
    - -t "#"
    - /#
    - +/#
  condition: selection_tool and selection_wildcard
falsepositives:
- Legitimate MQTT broker administrators or developers debugging topic structures with
  broad wildcard subscriptions during testing
- Monitoring or logging services intentionally subscribed to all topics for observability
  purposes
level: high
tags:
- attack.T1078
- attack.initial_access
- attack.persistence
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/07fcf2f3-c9d6-40da-88f6-11f9a52c5542/yarbo-robot-fleet-exposed-via-hardcoded-mqtt-credentials.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup