{"id":"66aa9619-89d9-416c-9cec-5d821c6226c2","slug":"yarbo-robot-security-vulnerabilities-2026-05","kind":"malfunction","headline":"Security researcher reveals Yarbo yard robots vulnerable to remote hijacking, camera access, and emergency-stop bypass","summary":"Security researcher Andreas Makris discovered a cluster of vulnerabilities in Yarbo yard robots including hardcoded root passwords shared across all devices, weak MQTT messaging security, and persistent remote tunnel backdoors. The flaws allowed attackers to remotely hijack the worldwide robot fleet, access GPS coordinates, Wi-Fi passwords, and camera feeds, and bypass the emergency stop button on a mower with controllable blades. Makris demonstrated the risk by having his Yarbo mower run him over. Yarbo responded by disabling remote diagnostic tunnels, resetting root passwords, locking down unauthenticated endpoints, and promising structural changes including unique per-device credentials and OTA credential rotation. CVE-2026-10557 was assigned.","occurredAt":"2026-05-11T00:00:00.000Z","reviewStatus":"reviewed","modelId":"b910a007-e2b9-4bbe-aef2-9ad96c0d437d","deploymentId":null,"companyId":null,"aliases":[],"collisionRisk":"none","reviewNote":null,"severity":"serious","rootCauseCategory":null,"rootCauseDetail":null,"affectedUnitsCount":null,"affectedUnitsBasis":null,"remediationStatus":null,"regulatoryAction":"inquiry_opened","regulatoryBody":"CISA","propertyDamageEstimateUsd":null,"damageEstimateBasis":null,"bodilyInjurySeverity":null,"fatalityCount":null,"lossCostClass":null,"sourceQualityTier":null,"oshaRecordable":null,"oshaCaseNumber":null,"rootCauseDisclosed":null,"publicDisclosureDate":null,"insuranceClaimPublic":null,"formFactor":null,"latitude":null,"longitude":null,"autonomyClass":null,"legalOutcomeClass":"unknown","createdAt":"2026-07-29T13:24:22.350Z","updatedAt":"2026-08-09T05:24:01.599Z","model":{"id":"b910a007-e2b9-4bbe-aef2-9ad96c0d437d","companyId":"c245caa6-536e-4e60-b489-571f7b6647ad","modelName":"Yarbo Lawn Mower Pro","slug":"yarbo-lawn-mower-pro","description":"The Yarbo Lawn Mower Pro is a lawn mower robot produced by Yarbo. It is classified as a commercial-stage product. No additional specifications or operational details are available from the provided fields.","formFactor":"lawn_mower","industryVertical":"consumer","environment":"outdoor","maturityStage":"commercial","lifecycleState":"active","supersededByModelId":null,"specs":{},"manufacturerSerial":null,"reviewStatus":"reviewed","sources":[{"url":"https://www.yarbo.com/collections/robot-lawn-mower","label":"Yarbo Lawn Mower Pro (Yarbo) -- maker page","title":"Yarbo Lawn Mower Pro (Yarbo) -- maker page","mediaType":"article","publishedAt":"2026-06-18"}],"aliases":[],"collisionRisk":"low","reviewNote":null,"manufacturerTermForTeleop":null,"keyFacts":[{"label":"Kickstarter 2022","value":"$3.5M"},{"label":"Kickstarter M Series","value":"$3.4M (2026)"},{"label":"Products","value":"Yarbo Lawn Mower Pro, Yarbo M"},{"label":"Category","value":"Modular yard robot (mowing, snow, leaf blowing)"}],"createdAt":"2026-06-27T19:59:11.428Z","updatedAt":"2026-07-12T04:24:55.531Z","unitsInFieldClaimed":null,"unitsInFieldVerified":null,"unitsManufacturedClaimed":null,"unitsManufacturedVerified":null,"unitsAsOf":null,"unitsSource":null,"salesModel":null,"priceUndisclosedSince":null,"autonomyClass":null,"autonomyStatement":null,"autonomyStatementSource":null,"demoForensics":null,"exportControlClass":null,"minCommitment":null,"warrantyTerms":null,"serviceModel":null,"productionRateClaimed":null,"productionRateEvidenced":null,"teleopRatioDisclosed":null,"interventionRateDisclosed":null},"deployment":null,"company":null,"derived":{"status":"active"},"sources":[{"id":"9d973237-5728-41e1-829d-90c275281742","incidentId":"66aa9619-89d9-416c-9cec-5d821c6226c2","url":"https://www.malwarebytes.com/blog/news/2026/05/yarbo-responds-to-robot-flaws-that-could-mow-down-their-owners","label":"Malwarebytes","publishedAt":"2026-05-11T00:00:00.000Z","notes":null,"title":null,"sourceName":"Malwarebytes","mediaType":"article","videoId":null,"channel":null,"durationSec":null,"timestampSec":null,"createdAt":"2026-07-29T13:24:22.350Z","updatedAt":"2026-07-29T13:24:22.350Z"},{"id":"189cc856-3522-43c1-9ab2-b0f681376287","incidentId":"66aa9619-89d9-416c-9cec-5d821c6226c2","url":"https://www.sentinelone.com/vulnerability-database/cve-2026-10557/","label":"SentinelOne CVE Database","publishedAt":"2026-05-11T00:00:00.000Z","notes":null,"title":null,"sourceName":"SentinelOne CVE Database","mediaType":"article","videoId":null,"channel":null,"durationSec":null,"timestampSec":null,"createdAt":"2026-07-29T13:24:22.350Z","updatedAt":"2026-07-29T13:24:22.350Z"}],"responses":[],"statusEvents":[{"id":"01376702-d22e-4d09-b5e5-41c65e13c7b5","incidentId":"66aa9619-89d9-416c-9cec-5d821c6226c2","status":"active","reason":null,"source":"agent:recon","effectiveAt":"2026-07-29T13:24:23.525Z","createdAt":"2026-07-29T13:24:23.525Z"}],"jsonLd":{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://registry.deploy.report/incidents/yarbo-robot-security-vulnerabilities-2026-05","url":"https://registry.deploy.report/incidents/yarbo-robot-security-vulnerabilities-2026-05","headline":"Security researcher reveals Yarbo yard robots vulnerable to remote hijacking, camera access, and emergency-stop bypass","description":"Security researcher Andreas Makris discovered a cluster of vulnerabilities in Yarbo yard robots including hardcoded root passwords shared across all devices, weak MQTT messaging security, and persistent remote tunnel backdoors. The flaws allowed attackers to remotely hijack the worldwide robot fleet, access GPS coordinates, Wi-Fi passwords, and camera feeds, and bypass the emergency stop button on a mower with controllable blades. Makris demonstrated the risk by having his Yarbo mower run him over. Yarbo responded by disabling remote diagnostic tunnels, resetting root passwords, locking down unauthenticated endpoints, and promising structural changes including unique per-device credentials and OTA credential rotation. CVE-2026-10557 was assigned.","identifier":"66aa9619-89d9-416c-9cec-5d821c6226c2","datePublished":"2026-05-11T00:00:00.000Z","articleSection":"malfunction","publisher":{"@id":"https://deploy.report/#organization"},"author":{"@id":"https://deploy.report/#organization"}},"framework_metadata":{"framework_schema_version":"0.1.0","verification_status":"verified","maturity_stage":null,"lifecycle_state":null,"architectural_position":{"cohort":null,"sub_cohorts":[]},"within_cohort_verified_vs_claimed_pair":null,"cap_flags":[],"verification_depth":{"sources_count":2,"primary_source_types":[]}}}