CVE-2026-2411: auth in zephyrproject zephyr
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c). When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement. A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact. The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.
AI Analysis
Technical Summary
Zephyr's Bluetooth host incorrectly performs security permission checks on GATT characteristic notifications and indications by evaluating the permissions of the Characteristic Declaration attribute (which is always readable) rather than the Characteristic Value attribute that carries the actual security permissions. This flaw allows a remote peer to enable notifications or indications via the Client Characteristic Configuration descriptor and receive protected characteristic values over a link that has not met the required encryption or authentication level. The Notify-Multiple path also omits enforcement of the LE Secure Connections requirement. The vulnerability results in unauthorized disclosure of characteristic values that the application intended to protect with encryption or authentication. The fix involves adding a function to resolve the attribute to the value attribute before permission checks and enforcing the full encryption mask in the Notify-Multiple path.
Potential Impact
The vulnerability allows a remote attacker to bypass intended access controls on Bluetooth GATT characteristic values by receiving notifications or indications without the required link security (encryption/authentication/LE Secure Connections). This leads to unauthorized information disclosure of protected characteristic data. There is no impact on system availability or memory safety. The exposure depends on the application using characteristics that require encryption or authentication for notifications or indications and having a Client Characteristic Configuration descriptor writable at a lower security level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix involving a new function to correctly resolve the attribute to the value attribute before permission checks and enforcing full encryption masks. Until an official patch or update is available, applications should review their use of Bluetooth GATT characteristics and consider restricting Client Characteristic Configuration descriptor write permissions to higher security levels to mitigate unauthorized notification enabling.
CVE-2026-2411: auth in zephyrproject zephyr
Description
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c). When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement. A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact. The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.
CVSS v3.1
Score 6.5medium
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zephyr's Bluetooth host incorrectly performs security permission checks on GATT characteristic notifications and indications by evaluating the permissions of the Characteristic Declaration attribute (which is always readable) rather than the Characteristic Value attribute that carries the actual security permissions. This flaw allows a remote peer to enable notifications or indications via the Client Characteristic Configuration descriptor and receive protected characteristic values over a link that has not met the required encryption or authentication level. The Notify-Multiple path also omits enforcement of the LE Secure Connections requirement. The vulnerability results in unauthorized disclosure of characteristic values that the application intended to protect with encryption or authentication. The fix involves adding a function to resolve the attribute to the value attribute before permission checks and enforcing the full encryption mask in the Notify-Multiple path.
Potential Impact
The vulnerability allows a remote attacker to bypass intended access controls on Bluetooth GATT characteristic values by receiving notifications or indications without the required link security (encryption/authentication/LE Secure Connections). This leads to unauthorized information disclosure of protected characteristic data. There is no impact on system availability or memory safety. The exposure depends on the application using characteristics that require encryption or authentication for notifications or indications and having a Client Characteristic Configuration descriptor writable at a lower security level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix involving a new function to correctly resolve the attribute to the value attribute before permission checks and enforcing full encryption masks. Until an official patch or update is available, applications should review their use of Bluetooth GATT characteristics and consider restricting Client Characteristic Configuration descriptor write permissions to higher security levels to mitigate unauthorized notification enabling.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-02-12T16:12:13.715Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6de418bf32cb7a34b97a18
Added to database: 08/01/2026, 12:18:32 UTC
Last enriched: 08/08/2026, 14:26:08 UTC
Last updated: 09/14/2026, 22:01:33 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.