Yarbo’s mobile app and cloud backend treat one credential as access to the whole fleet. That means pulling a secret from any app binary is not a user-level leak; it is a control-plane problem for every robot connected to the service.
CISA says the Android and iOS app embeds the same MQTT broker credentials for all users and devices, and those credentials can be extracted from the binary. The same advisory says Yarbo’s cloud does not enforce per-device or per-user authorization, so any valid credential can pull global telemetry and send commands to any robot once the serial number is known.
Version 3.17.4 or later removes the hard-coded app secret, but the backend issue means the blast radius does not end with the app fix. A single compromised credential can still reach the full fleet until server-side authorization is in place.