---
id: CVE-2026-77061
title: Missing Authentication for Critical Function in boneIO
summary: >-
  boneIO Black directly excludes several API endpoints from the authentication.
  An unauthenticated remote attacker on the local network can retrieve system
  logs, firmware version, serial number, MQTT username, configuration file
  listings, …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: boneIO
product: boneio
affected:
  - boneio >= 1.2.0 < 1.6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T15:29:54.885585Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:35:49.857Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-77061'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-77052'
  - url: 'https://boneio.eu/en/docs/black'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.508Z'
---

## Overview

boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device.
This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.

## Affected

- `boneio >= 1.2.0 < 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.