VulnerabilityPublished 1 Aug 2026Updated 31 Aug 2026

CVE-2026-2411: zephyrproject zephyr · Auth

Affects zephyrproject zephyrSource CVE Database V5

Compare

Not known to be exploited · CVSS 6.5 Medium : upgrade to 4.4.2 or 4.3.1 when convenient.

Data as of 30 Oct 2026, 20:25 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 4.4.2, 4.3.1

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade zephyrproject zephyr to 4.4.2 or 4.3.1.

Affected software

Product	Affected	Fixed in
zephyrprojectzephyr	Affected >=4.4.0 <4.4.2	Fixed in 4.4.2
zephyrprojectzephyr	Affected >=2.6.0 <4.3.1	Fixed in 4.3.1
GitHubzephyr`pkg:github/zephyr`Other threats	Affected >=2.6.0 <4.3.1 >=4.4.0 <4.4.2	Fixed in 4.3.1 4.4.2

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The vendor has described a fix involving a new function to correctly resolve the attribute to the value attribute before permission checks and enforcing full encryption masks. Until an official patch or update is available, applications should review their use of Bluetooth GATT characteristics and consider restricting Client Characteristic Configuration descriptor write permissions to higher security levels to mitigate unauthorized notification enabling.

Description

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c). When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement. A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact. The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.

Impact

The vulnerability allows a remote attacker to bypass intended access controls on Bluetooth GATT characteristic values by receiving notifications or indications without the required link security (encryption/authentication/LE Secure Connections). This leads to unauthorized information disclosure of protected characteristic data. There is no impact on system availability or memory safety. The exposure depends on the application using characteristics that require encryption or authentication for notifications or indications and having a Client Characteristic Configuration descriptor writable at a lower security level.

Summary

Zephyr's Bluetooth host incorrectly performs security permission checks on GATT characteristic notifications and indications by evaluating the permissions of the Characteristic Declaration attribute (which is always readable) rather than the Characteristic Value attribute that carries the actual security permissions. This flaw allows a remote peer to enable notifications or indications via the Client Characteristic Configuration descriptor and receive protected characteristic values over a link that has not met the required encryption or authentication level. The Notify-Multiple path also omits enforcement of the LE Secure Connections requirement. The vulnerability results in unauthorized disclosure of characteristic values that the application intended to protect with encryption or authentication. The fix involves adding a function to resolve the attribute to the value attribute before permission checks and enforcing the full encryption mask in the Notify-Multiple path.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Aug 2026, 14:26 UTC

Technical details

References

Community reviews

Related threats