CVE-2026-96456 Overview
CVE-2026-96456 is an authentication flaw [CWE-287] in the Reachy Mini Bluetooth service maintained by Pollen Robotics. The service prompts a connecting device for a PIN before accepting commands, but the authenticated state is stored in a single shared flag on the service instance. Once any device completes the PIN exchange, every device in Bluetooth range can send CMD_ commands until the flag resets. An attacker in radio range rides along on a legitimate user's successful authentication without ever guessing or brute-forcing the PIN.
Critical Impact
This vulnerability forms the second link in a three-step exploitation chain documented by JFrog. Combined with CVE-2026-55419 (unrestricted file upload) and CVE-2026-62661 (path traversal in the Bluetooth command handler), it enables an attacker-controlled script to execute as root on the robot.
Affected Products
- Reachy Mini robot by Pollen Robotics
- The reachy_mini daemon Bluetooth service component
- Installations exposing the WriteValue characteristic handler in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py
Discovery Timeline
- 2026-09-23 - CVE-2026-96456 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-96456
Vulnerability Analysis
The Reachy Mini Bluetooth service enforces a PIN prompt before accepting robot commands. The check validates that a session was authenticated but does not validate which device sent any given write. BlueZ passes the calling device's identity to the characteristic write handler through the options argument. The WriteValue(self, value, options) implementation ignores options entirely and cannot distinguish the authenticated device from any other device in range.
The authenticated state persists in a single shared boolean flag on the service instance. Once set by any successful PIN exchange, the flag applies globally. Any nearby device can then issue CMD_ commands until the flag resets. This design turns per-connection authentication into a shared, ambient permission across all Bluetooth peers within radio range.
Root Cause
The root cause is improper authentication scope. Session authentication state is stored on the service singleton rather than tracked per device identity. The handler discards the caller identity supplied by BlueZ, so no authorization check binds a specific command to a specific authenticated peer. See the GitHub Security Advisory GHSA-993g-hgjh-whmf for the official write-up.
Attack Vector
An attacker within Bluetooth radio range of the target waits for a legitimate user to complete PIN authentication. After the shared flag is set, the attacker writes CMD_ payloads to the same characteristic. The service processes those writes as authenticated commands. When chained with the file upload flaw (CVE-2026-55419) and the path traversal flaw (CVE-2026-62661), the attacker executes a previously uploaded script as root.
Refer to the Bluetooth service source for the affected handler.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-96456
Indicators of Compromise
- Unexpected CMD_ writes to the Reachy Mini Bluetooth characteristic from devices not associated with the current operator session
- Bluetooth pairing or connection events from unknown device MAC addresses coincident with legitimate user activity
- Execution of unfamiliar scripts under the daemon service account on the robot filesystem
Detection Strategies
- Enable BlueZ logging with bluetoothd -d and correlate WriteValue events with the authenticated device identity to identify writes from unexpected peers
- Monitor for new files landing in the media sounds upload directory followed by Bluetooth command activity, which indicates chained exploitation with CVE-2026-55419 and CVE-2026-62661
- Audit process execution logs on the robot for scripts spawned by the Bluetooth service outside of documented operational workflows
Monitoring Recommendations
- Track Bluetooth Low Energy connection counts and pairing attempts in physical proximity to deployed robots
- Alert when the Reachy Mini daemon accepts commands from a device MAC that differs from the last authenticated peer
- Forward daemon logs and system audit records to a centralized log store for retention and correlation across incidents
How to Mitigate CVE-2026-96456
Immediate Actions Required
- Restrict physical and radio access to Reachy Mini deployments until a fixed release is applied
- Disable the Bluetooth service on the robot where remote command access is not required
- Review the GitHub Reachy Mini repository for the latest release notes and apply any published patch that binds authentication state to the calling device
Patch Information
A vendor patch reference is tracked in the GitHub Security Advisory GHSA-993g-hgjh-whmf. The correct fix updates WriteValue(self, value, options) to read the caller identity from options and compare it against the device that completed the PIN exchange. Deploy the fixed release together with patches for CVE-2026-55419 and CVE-2026-62661 to break the full exploitation chain.
Workarounds
- Operate the robot only in shielded or isolated environments where no untrusted Bluetooth peer can enter radio range during authenticated sessions
- Reset the authenticated flag by restarting the Bluetooth service immediately after each operator session to shorten the exploitation window
- Remove or lock down write access to the media sounds upload path to prevent the file upload precondition from being satisfied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
