{"id":"CVE-2026-66279","kind":"vulnerability","aliases":["CVE-2026-66279"],"related":[],"title":"Connect SDK and Flex SDK: crafted message bypasses authentication, disrupts network","description":"In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.","summary":"Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier accept a message with invalid security settings that can get past authentication. An attacker can use it to disrupt network traffic, but the sources say it does not expose the Network Key or break confidentiality.","severity":"high","cvss":7.2,"epss":0.00245,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["connect-sdk","flex-sdk","network","package"],"not_affected_if":["sdk-not-used"],"how_to_check":"- Check the installed Connect SDK version against `4.3.1` and the Flex SDK version against `3.7.7`, in the project's dependency manifest or lockfile\n- unknown whether other check paths exist; the sources do not say","fix":"- Upgrade Connect SDK to a release newer than `4.3.1`\n- Upgrade Flex SDK to a release newer than `3.7.7`\n- unknown exact fixed versions; the sources do not name them","status":"open","published_at":"2026-10-22T14:17:43+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:27:52+00:00","updated_at":"2026-10-25T03:27:52+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:27:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Connect SDK to a release newer than `4.3.1`\n- Upgrade Flex SDK to a release newer than `3.7.7`\n- unknown exact fixed versions; the sources do not name them","reach":"unknown","title":"Connect SDK and Flex SDK: crafted message bypasses authentication, disrupts network","impact":"medium","summary":"Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier accept a message with invalid security settings that can get past authentication. An attacker can use it to disrupt network traffic, but the sources say it does not expose the Network Key or break confidentiality.","category":"package","nicknames":[],"who_cares":["connect-sdk","flex-sdk","network"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker disrupts network traffic by bypassing authentication; confidentiality kept","analyst_note":"Find the vendor advisory and fixed versions for Connect SDK and Flex SDK, and confirm the reachable message path and auth requirements.","how_to_check":"- Check the installed Connect SDK version against `4.3.1` and the Flex SDK version against `3.7.7`, in the project's dependency manifest or lockfile\n- unknown whether other check paths exist; the sources do not say","needs_analyst":true,"not_affected_if":["sdk-not-used"],"who_is_affected":"Teams whose applications embed Connect SDK 4.3.1 or earlier, or Flex SDK 3.7.7 or earlier, and accept messages from a network source. The sources do not describe the exact message path or configuration that makes an application reachable. Teams not using either SDK can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3366,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-66279':14A,17A '3.7.7':34B,81C '4.3.1':28B,75C 'accept':37B 'allow':101C 'attack':50B,103C 'authent':9A,48B,92C 'break':70B,111C 'bypass':8A,91C 'confidenti':71B,112C 'connect':1A,19B,26B,73C 'connect-sdk':18B 'craft':6A 'cve':12A,15A 'disrupt':10A,55B,96C 'earlier':30B,36B,77C,83C 'expos':65B 'flex':4A,22B,32B,79C 'flex-sdk':21B 'gain':105C 'get':46B 'invalid':41B,87C 'key':68B,108C 'may':90C 'messag':7A,39B,85C 'network':11A,24B,56B,67B,95C,107C 'otherwis':110C 'packag':25B 'past':47B 'result':93C 'say':61B 'sdk':2A,5A,20B,23B,27B,33B,74C,80C 'secur':42B,88C 'set':43B,89C 'sourc':60B 'traffic':57B 'use':52B 'vulner':98C","nicknames":[],"mitigations":[],"who_affected":"Teams whose applications embed Connect SDK 4.3.1 or earlier, or Flex SDK 3.7.7 or earlier, and accept messages from a network source. The sources do not describe the exact message path or configuration that makes an application reachable. Teams not using either SDK can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T14:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"product-security@silabs.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66279","severity":null,"published_at":"2026-10-22T14:17:43+00:00","modified_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-66279","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66279","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}