Yarbo Cloud Missing Authorization Controls for Robot Fleet

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-coded credentials from the app, a single compromised credential could still provide fleet-wide access without per-device access controls.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-7368 exposes a critical authorization flaw in the Yarbo cloud platform where per-device and per-user access controls are entirely absent. Any authenticated user—whether using shared hard-coded credentials or legitimate credentials—can subscribe to wildcard MQTT topics to monitor all robots globally and publish commands to any robot by simply knowing its serial number (which leaks via telemetry). This vulnerability affects all organizations deploying Yarbo robots, creating a scenario where a single compromised credential grants an attacker complete fleet-wide command and control capabilities. The risk is compounded by the difficulty in revoking access; even after removing hard-coded credentials, the authorization gap remains fundamentally unfixed.

Casky.ai's 261 matching skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky's Claude-powered analysis would identify indicators including: unauthorized MQTT subscription patterns to wildcard topics from unexpected source IPs, lateral movement across device command channels using enumerated serial numbers, and privilege escalation signatures where low-privilege credentials suddenly access high-value robot control topics. The platform's extended reasoning capabilities would correlate telemetry leakage (serial number exposure) with subsequent command injection attempts, surfacing the authorization bypass as a multi-stage attack chain rather than isolated events. Security teams would see findings highlighting missing role-based access controls (RBAC) and the absence of device-specific authorization checks at the broker level.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7368.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-7368

Casky has 261 skills that investigate the attack patterns behind CVE-2026-7368. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn