CVE-2026-10772
Summary
by MITRE • 08/01/2026
Rejected reason: ** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration attribute rather than the Characteristic Value attribute, so the encryption/authentication requirements configured on the value are not enforced. Both identifiers describe the same root cause in subsys/bluetooth/host/gatt.c, fixed by the same commit (c3386f92fe81bd10dc23e6a115e6a80a7d863546). Use CVE-2026-2411 instead.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability described in this rejected CVE record represents a critical authorization flaw within the Zephyr Project's Bluetooth implementation that affects the Generic Attribute Profile (GATT) service. This issue stems from an improper permission validation mechanism during Bluetooth GATT notify/indicate operations, where the system incorrectly evaluates access controls by checking the Characteristic Declaration attribute permissions instead of the Characteristic Value attribute permissions. The flaw exists in the subsys/bluetooth/host/gatt.c file and demonstrates a fundamental misconfiguration in how the Bluetooth stack enforces security policies for attribute access.
The technical implementation error creates a scenario where encryption and authentication requirements configured specifically for the characteristic value are completely bypassed during notification and indication operations. This represents a direct violation of the principle of least privilege and undermines the security model designed to protect sensitive data transmission over Bluetooth connections. The vulnerability allows unauthorized parties to potentially access or modify data that should be restricted based on the configured security settings for the characteristic value itself.
From an operational perspective, this flaw could enable attackers to exploit the Bluetooth GATT service to access protected data without proper authentication or encryption, depending on how the system is configured. The impact extends beyond simple data exposure to potential privilege escalation within the Bluetooth communication framework, as the system fails to enforce the security policies that should govern characteristic value access. This vulnerability affects any Zephyr-based system implementing Bluetooth GATT services where notify/indicate operations are used, potentially compromising the confidentiality and integrity of all data transmitted through these mechanisms.
The mitigation for this vulnerability requires updating to a version containing the fix referenced in commit c3386f92fe81bd10dc23e6a115e6a80a7d863546, which corrects the permission checking logic to properly validate Characteristic Value attribute permissions instead of the Declaration attribute permissions. Organizations should also review their Bluetooth security configurations to ensure that proper encryption and authentication requirements are consistently applied across all characteristic attributes. This fix aligns with the broader security principles outlined in CWE-284 for improper access control and addresses similar threats documented in ATT&CK techniques related to privilege escalation and data exposure through network services.
The duplicate assignment of this vulnerability to CVE-2026-2411 reflects the industry's standard practice of consolidating multiple identifiers for the same root cause, ensuring that security advisories and patch management efforts focus on the single, definitive fix. This consolidation helps prevent confusion in security tracking systems and ensures that all stakeholders reference the correct remediation approach for addressing the underlying authorization flaw in the Zephyr Bluetooth implementation. The vulnerability serves as a reminder of the importance of thorough permission validation in embedded systems where security policies must be consistently enforced across all communication pathways.