CVE-2026-10557

Name of the Vulnerable Software and Affected Versions Yarbo Android and iOS applications (affected versions not specified)

Description The Android and iOS applications contain hard-coded MQTT broker credentials that are identical across all users and devices. These credentials, embedded in the application binary, can be extracted through APK decompilation. This allows unauthorized access to cloud MQTT brokers that handle real-time telemetry for the global robot fleet. An attacker can use these credentials to perform wildcard subscriptions to all robot telemetry topics or publish messages to any robot's command topic by providing the robot's serial number.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.