Yarbo's mobile app shipped with hard-coded MQTT credentials that gave anyone subscriber access to every robot's telemetry and the ability to issue commands to any device in the global fleet.
Security researcher Markus Lassfolk of Truesec found two separate flaws and reported them to CISA. The first, rated CVSS 9.8, is a classic: credentials embedded in the Android and iOS app binaries, identical across every Yarbo device globally, readily extracted by decompiling the APK. Those credentials subscribed to real-time telemetry for the entire fleet and let an attacker publish movement commands to any robot using only its serial number. The second flaw, rated CVSS 8.1, runs deeper: Yarbo's cloud enforced no per-device or per-user access controls, so even without the hard-coded shortcut, a single compromised legitimate account could reach every robot on the platform. Yarbo says app version 3.17.4 removes the hard-coded credentials; a May 2026 server-side update enforces broker authorization automatically, with no user action required beyond updating the app.
The authorization gap is the harder problem. A cloud architecture that never asked whether a user was allowed to talk to a specific robot requires a redesign, not just a patched credential. That second CVE survives the app update entirely on its own terms: one stolen account still means fleet-wide access until the server-side fix propagates.
Hard-coded IoT credentials have appeared on vulnerability lists for over a decade. Consumer robotics is simply the latest category to discover that "works at launch" and "designed to be secure" are not the same requirement.