CVE-2026-8676: Bluetooth LE Auth Bypass Vulnerability

CVE-2026-8676 Overview

CVE-2026-8676 is a Bluetooth Low Energy (LE) authentication weakness affecting Silicon Labs Bluetooth software. An attacker within radio range can delete an existing bond, impersonate the bonded device, and re-bond with reduced security parameters. This bypasses the authenticated pairing previously established between the two devices and downgrades the connection to a weaker security mode. The flaw is tracked under CWE-290 (Authentication Bypass by Spoofing). Successful exploitation enables full compromise of confidentiality, integrity, and availability of the affected BLE link.

Critical Impact
An adjacent attacker can spoof a bonded BLE peer and force a downgraded pairing, undermining encryption and authentication guarantees between paired devices.

Affected Products

Silicon Labs Bluetooth software stack (versions prior to 9.0.0.0)
Devices using Silicon Labs BLE bonding and pairing implementations
Embedded products built on affected Silicon Labs Bluetooth SDK releases

Discovery Timeline

2026-05-26 - CVE-2026-8676 published to the National Vulnerability Database
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8676

Vulnerability Analysis

The vulnerability resides in how the Bluetooth LE stack handles bond lifecycle events. Bonding stores long-term keys (LTKs) and identity information after a successful pairing. The affected stack permits an attacker within adjacent network range to trigger removal of an existing bond and immediately initiate a new pairing while spoofing the legitimate peer's address. Because the stack does not enforce continuity or attestation of the prior bonded identity, the new pairing can complete with weaker security properties than the original. The attacker effectively replaces a trusted bonded device with an attacker-controlled endpoint that holds equivalent privileges over the BLE service.

Root Cause

The root cause is improper validation of peer authenticity during bond replacement [CWE-290]. The pairing state machine treats a bond deletion and subsequent re-bond as an independent transaction. It does not require the new pairing to meet or exceed the security level of the prior bond. An attacker who knows or observes the bonded peer's identity address can present that address during the new pairing exchange and negotiate Just Works pairing or another unauthenticated mode.

Attack Vector

Exploitation requires Bluetooth LE radio proximity to the target device. No prior authentication or user interaction is needed. The attacker triggers bond deletion through legitimate protocol mechanisms or by inducing the target to clear its bond table. The attacker then advertises or initiates a connection using the spoofed identity address and negotiates a pairing method with lower security guarantees. Once the new bond is established, the attacker can read, write, or modify GATT characteristics that were protected by the original authenticated bond. See the Silicon Labs Community Post for vendor-supplied technical context.

Detection Methods for CVE-2026-8676

Indicators of Compromise

Unexpected bond deletion events recorded in BLE host logs or device telemetry
Re-pairing events for previously bonded peers using Just Works or unauthenticated pairing modes
Rapid sequence of disconnection, bond removal, and new pairing involving the same identity address
BLE advertisements from devices with identity addresses that match known bonded peers but appear at unusual times or signal strengths

Detection Strategies

Monitor BLE host stack events for bond_deleted followed by pairing_complete with reduced security mode
Correlate Link Layer connection events with bonding state changes to flag identity address reuse
Log and alert on pairing negotiations that result in security mode 1 level 1 or 2 when a higher level was previously in use

Monitoring Recommendations

Enable verbose Bluetooth host logging on devices managing sensitive BLE peers
Forward BLE security events to a central log platform for correlation across fleet devices
Track firmware versions across deployed Silicon Labs Bluetooth devices to identify unpatched units

How to Mitigate CVE-2026-8676

Immediate Actions Required

Inventory all devices running Silicon Labs Bluetooth software and identify versions earlier than 9.0.0.0
Apply the fixed firmware referenced in the Silicon Labs Bluetooth Release Notes 9.0.0.0
Require authenticated pairing methods such as Passkey Entry or Numeric Comparison for all bonded peers
Reject pairing attempts that would lower the security level of an existing bonded relationship

Patch Information

Silicon Labs addresses CVE-2026-8676 in Bluetooth software release 9.0.0.0. The release notes describe the corrected bonding behavior and additional security hardening. Operators of affected products should deploy the updated SDK, rebuild firmware images, and distribute updates through their standard OTA or provisioning channels.

Workarounds

Disable bonding on BLE peripherals that do not strictly require persistent keys
Configure applications to enforce LE Secure Connections with MITM protection and refuse fallback to legacy or Just Works pairing
Restrict physical and radio access to deployed BLE devices in sensitive environments until firmware updates are applied

bash

# Configuration example - enforce LE Secure Connections with MITM protection
# Refer to Silicon Labs Bluetooth API documentation for exact syntax
sl_bt_sm_configure(
    SL_BT_SM_CONFIGURATION_BONDING_REQUIRES_MITM |
    SL_BT_SM_CONFIGURATION_ENCRYPTION_REQUIRES_BONDING |
    SL_BT_SM_CONFIGURATION_CONFIRM_BONDING_REQUEST,
    sl_bt_sm_io_capability_displayyesno
);