CVE-2026-77055

The record

boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.

Affected packages

Related vulnerabilities

• CVE-2026-121539 A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. CWE-266
• CVE-2026-121514 A weakness has been identified in EasySoft ZenTao PMS up to 22.6. CWE-266
• CVE-2026-119922 Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5… CWE-266
• CVE-2026-120224 A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. CWE-266
• CVE-2026-120185 A security flaw has been discovered in ken678 YznCMS up to 2.2.0. CWE-266
• CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
• CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
• CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266