What is GHSA-mpp4-mc8m-6vpc?

GHSA-mpp4-mc8m-6vpc is a security advisory published by GitHub Security Advisories with Medium severity. boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto...

Which CVE IDs does GHSA-mpp4-mc8m-6vpc cover?

GHSA-mpp4-mc8m-6vpc covers the following CVE IDs: CVE-2026-77060. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-mpp4-mc8m-6vpcMedium

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto...

Vendor

GitHub Security Advisories

Published

October 26, 2026

Last Modified

October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-77060 →

📋 Description

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.

This issue was fixed in version 1.6.0.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-77060
https://boneio.eu/en/docs/black
https://cert.pl/en/posts/2026/10/CVE-2026-77052
https://github.com/advisories/GHSA-mpp4-mc8m-6vpc