CVE-2026-10557: Hard‑coded MQTT credentials expose Yarbo robot telemetry and commands

CISA has published an ICS advisory describing critical issues in the Yarbo Android and iOS mobile applications and associated cloud MQTT infrastructure. The centerpiece, tracked as CVE-2026-10557, involves hard‑coded MQTT broker credentials embedded in the mobile apps. According to the advisory materials, these credentials are identical across all users and devices, can be extracted from the application package, and permit access to cloud brokers that carry real‑time telemetry for Yarbo robots worldwide. The same access reportedly enables wildcard subscription to telemetry topics and publishing to robot command topics when the robot’s serial number is known.

CISA rates the overall severity as Critical (CVSS v3 9.8). The advisory notes risks that include obtaining hard‑coded credentials, accessing telemetry, and potentially sending operational commands to the robot fleet. At the time of writing, the public materials do not outline remediation steps or timelines.

What CVE-2026-10557 describes

The advisory content indicates the Yarbo mobile apps contain static, hard‑coded credentials for the MQTT broker. In MQTT, clients publish and subscribe to topics to exchange data. Using credentials that are shared across all customers eliminates per‑user isolation and creates a fleet‑wide exposure. The documents linked by CISA state that:

• The credentials are embedded in the application binary and are readily extractable via APK decompilation.
• They provide access to cloud MQTT brokers carrying real‑time telemetry for the global Yarbo robot fleet.
• They allow wildcard subscription to robot telemetry topics and publishing to robot command topics using only a robot’s serial number.

In practical terms, this means unauthorized parties who obtain the shared credentials could eavesdrop on telemetry and, if they also know a device’s serial number, attempt to publish commands. The advisory groups these issues under “Use of Hard‑coded Credentials” and references “Missing Authorization” within the broader product context.

Why it matters

Connected robots rely on cloud messaging to coordinate status and control. When a single set of credentials can reach many devices, the blast radius is unusually large: telemetry privacy is at risk, and the path to issuing commands becomes simpler. Even without proof of active exploitation in public sources, the combination of shared credentials, wildcard topic access, and serial‑number–based command publishing is a high‑impact design flaw that merits fast attention from owners and administrators.

Practical steps for owners and admins

The public advisories do not include a fix at this time. Until vendor guidance is available, a cautious, defensive posture is appropriate:

• Monitor official sources for updates and mitigations: CISA’s advisory page and Yarbo’s communications.
• Apply mobile app updates promptly once a fix is released.
• Treat robot serial numbers as sensitive; avoid sharing them publicly or in support forums where they can be harvested.
• Review who has access to the Yarbo mobile app in your environment and remove unnecessary access.
• Place robots and their controllers on segmented networks; restrict unnecessary outbound and inbound connections where feasible.
• Watch for unusual behavior or unexpected movements and contact the vendor if observed.
• If the product provides options to limit remote commands or cloud connectivity, consider enabling those settings in accordance with vendor guidance.

These measures are general good practice for connected devices and do not replace vendor‑issued mitigations.

What remains unclear

Based on the publicly available materials linked below, several details are not specified:

• Whether the hard‑coded credentials have been rotated or revoked.
• Which app versions or cloud components are remediated, if any.
• Any timeline for permanent fixes or architectural changes.

Users and administrators should rely on the advisory pages for the latest status.

Sources

• CISA ICS Advisory: Yarbo Android/iOS Mobile Application and Cloud Infrastructure — CVE-2026-10557 (Critical, CVSS v3 9.8): https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01
• CISA CSAF JSON (advisory details as referenced by NVD): https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-01.json

—

Author: Alex Mira, AI Research Writer at Toolslib

Bio: Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Alex helps transform technical cybersecurity and software topics into clear, practical articles for developers, analysts, and everyday users.

Disclosure: Alex Mira is not a real person. Content under this profile may be AI-assisted and should follow Toolslib’s editorial standards.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.