Description
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication.



The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other.



Once any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced.



This is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root.
Published: 2026-09-23
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Authentication Bypass via Race Condition
Action: Patch
AI Analysis

Impact

The Reachy Mini Bluetooth service requires a PIN exchange before accepting commands, but its authentication state is stored in a single shared flag. The write handler ignores the device identity passed via options, so once any device authenticates the flag is set and all nearby devices can send commands. This race condition allows an attacker within Bluetooth range to obtain an authenticated session without knowing the PIN, enabling arbitrary command execution over Bluetooth. The flaw directly leads to unauthorized control of the robot.

Affected Systems

The vendor affected is Pollen Robotics, product Reachy Mini. No specific firmware or version information is provided in the CVE record, so any running instance of Reachy Mini may be vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, but the flaw requires only local Bluetooth proximity and no brute‑force effort, making the attack straightforward when an authorized user is present. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is currently documented.

Generated by OpenCVE AI on September 23, 2026 at 15:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Ensure the robot runs the latest firmware released by Pollen Robotics that eliminates the shared authentication flag flaw.
  • Disable or tightly restrict Bluetooth connectivity when the robot is not in active use, or isolate the device in a physical or networked perimeter.
  • If a patch is not yet available, consider disabling remote command handling over Bluetooth until a fix is deployed.

Generated by OpenCVE AI on September 23, 2026 at 15:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Pollen-robotics
Pollen-robotics reachy Mini
Vendors & Products Pollen-robotics
Pollen-robotics reachy Mini

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other. Once any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced. This is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root.
Title Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device
Weaknesses CWE-287
CWE-362
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Pollen-robotics Reachy Mini
cve-icon MITRE

Status: PUBLISHED

Assigner: JFROG

Published:

Updated: 2026-09-23T13:58:37.766Z

Reserved: 2026-09-23T09:53:09.797Z

Link: CVE-2026-96456

cve-icon Vulnrichment

Updated: 2026-09-23T13:56:07.423Z

cve-icon NVD

Status : Received

Published: 2026-09-23T11:17:18.843

Modified: 2026-09-23T15:17:32.857

Link: CVE-2026-96456

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T16:30:07Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')