Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-108269 (GCVE-0-2026-108269)

Vulnerability from nvd – Published: 2026-10-09 21:15 – Updated: 2026-10-09 21:15

Title

ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

Summary

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/ra-tls-clients/securi…	x_refsource_CONFIRM
https://github.com/Privasys/ra-tls-clients/commit…	x_refsource_MISC
https://github.com/Privasys/ra-tls-clients/releas…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	ra-tls-clients	Affected: < 0.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ra-tls-clients",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:15:12.264Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx"
        },
        {
          "name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx"
        },
        {
          "name": "https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148"
        },
        {
          "name": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-5qrc-v874-mxvx",
        "discovery": "UNKNOWN"
      },
      "title": "ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108269",
    "datePublished": "2026-10-09T21:15:12.264Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:15:12.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108268 (GCVE-0-2026-108268)

Vulnerability from nvd – Published: 2026-10-09 21:13 – Updated: 2026-10-09 21:13

Title

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

Summary

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Privasys/enclave-os-virtual/se…	x_refsource_CONFIRM
https://github.com/Privasys/enclave-os-virtual/co…	x_refsource_MISC
https://github.com/Privasys/enclave-os-virtual/re…	x_refsource_MISC
https://github.com/Privasys/enclave-os-virtual/re…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	enclave-os-virtual	Affected: < tdx-v0.2.43 Affected: < tdx-gpu-v0.6.27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "enclave-os-virtual",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c tdx-v0.2.43"
            },
            {
              "status": "affected",
              "version": "\u003c tdx-gpu-v0.6.27"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:13:33.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-p5fp-g94g-g9m9",
        "discovery": "UNKNOWN"
      },
      "title": "enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108268",
    "datePublished": "2026-10-09T21:13:33.595Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:13:33.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108267 (GCVE-0-2026-108267)

Vulnerability from nvd – Published: 2026-10-09 21:11 – Updated: 2026-10-09 21:11

Title

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Summary

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/go/security/advisorie…	x_refsource_CONFIRM
https://github.com/Privasys/go/commit/00a7d21ba53…	x_refsource_MISC
https://github.com/Privasys/go/releases/tag/priva…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	go	Affected: < privasys-v0.5.1-go1.26.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "go",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c privasys-v0.5.1-go1.26.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:11:33.186Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2"
        },
        {
          "name": "https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700"
        },
        {
          "name": "https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-7jfw-53rm-phh2",
        "discovery": "UNKNOWN"
      },
      "title": "Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108267",
    "datePublished": "2026-10-09T21:11:33.186Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:11:33.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108266 (GCVE-0-2026-108266)

Vulnerability from nvd – Published: 2026-10-09 21:00 – Updated: 2026-10-09 21:00

Title

Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Summary

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/rustls/security/advis…	x_refsource_CONFIRM
https://github.com/Privasys/rustls/commit/ab63058…	x_refsource_MISC
https://github.com/Privasys/rustls/releases/tag/p…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	rustls	Affected: < privasys-v0.8.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rustls",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c privasys-v0.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:00:19.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492"
        },
        {
          "name": "https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200"
        },
        {
          "name": "https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-j6qv-435v-r492",
        "discovery": "UNKNOWN"
      },
      "title": "Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108266",
    "datePublished": "2026-10-09T21:00:19.595Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:00:19.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108265 (GCVE-0-2026-108265)

Vulnerability from nvd – Published: 2026-10-09 20:55 – Updated: 2026-10-09 20:55

Title

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

Summary

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/enclave-os-mini/secur…	x_refsource_CONFIRM
https://github.com/Privasys/enclave-os-mini/commi…	x_refsource_MISC
https://github.com/Privasys/enclave-os-mini/relea…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	enclave-os-mini	Affected: < wasm-v0.40.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "enclave-os-mini",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c wasm-v0.40.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime\u0027s RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T20:55:54.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-49qm-4pj3-w2c6",
        "discovery": "UNKNOWN"
      },
      "title": "enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108265",
    "datePublished": "2026-10-09T20:55:54.705Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T20:55:54.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108269 (GCVE-0-2026-108269)

Vulnerability from cvelistv5 – Published: 2026-10-09 21:15 – Updated: 2026-10-09 21:15

Title

ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

Summary

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/ra-tls-clients/securi…	x_refsource_CONFIRM
https://github.com/Privasys/ra-tls-clients/commit…	x_refsource_MISC
https://github.com/Privasys/ra-tls-clients/releas…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	ra-tls-clients	Affected: < 0.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ra-tls-clients",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:15:12.264Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx"
        },
        {
          "name": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx"
        },
        {
          "name": "https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148"
        },
        {
          "name": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-5qrc-v874-mxvx",
        "discovery": "UNKNOWN"
      },
      "title": "ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108269",
    "datePublished": "2026-10-09T21:15:12.264Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:15:12.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108268 (GCVE-0-2026-108268)

Vulnerability from cvelistv5 – Published: 2026-10-09 21:13 – Updated: 2026-10-09 21:13

Title

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

Summary

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Privasys/enclave-os-virtual/se…	x_refsource_CONFIRM
https://github.com/Privasys/enclave-os-virtual/co…	x_refsource_MISC
https://github.com/Privasys/enclave-os-virtual/re…	x_refsource_MISC
https://github.com/Privasys/enclave-os-virtual/re…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	enclave-os-virtual	Affected: < tdx-v0.2.43 Affected: < tdx-gpu-v0.6.27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "enclave-os-virtual",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c tdx-v0.2.43"
            },
            {
              "status": "affected",
              "version": "\u003c tdx-gpu-v0.6.27"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:13:33.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-p5fp-g94g-g9m9",
        "discovery": "UNKNOWN"
      },
      "title": "enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108268",
    "datePublished": "2026-10-09T21:13:33.595Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:13:33.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108267 (GCVE-0-2026-108267)

Vulnerability from cvelistv5 – Published: 2026-10-09 21:11 – Updated: 2026-10-09 21:11

Title

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Summary

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/go/security/advisorie…	x_refsource_CONFIRM
https://github.com/Privasys/go/commit/00a7d21ba53…	x_refsource_MISC
https://github.com/Privasys/go/releases/tag/priva…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	go	Affected: < privasys-v0.5.1-go1.26.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "go",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c privasys-v0.5.1-go1.26.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:11:33.186Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2"
        },
        {
          "name": "https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700"
        },
        {
          "name": "https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-7jfw-53rm-phh2",
        "discovery": "UNKNOWN"
      },
      "title": "Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108267",
    "datePublished": "2026-10-09T21:11:33.186Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:11:33.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108266 (GCVE-0-2026-108266)

Vulnerability from cvelistv5 – Published: 2026-10-09 21:00 – Updated: 2026-10-09 21:00

Title

Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

Summary

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/rustls/security/advis…	x_refsource_CONFIRM
https://github.com/Privasys/rustls/commit/ab63058…	x_refsource_MISC
https://github.com/Privasys/rustls/releases/tag/p…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	rustls	Affected: < privasys-v0.8.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rustls",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c privasys-v0.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T21:00:19.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492"
        },
        {
          "name": "https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde200"
        },
        {
          "name": "https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-j6qv-435v-r492",
        "discovery": "UNKNOWN"
      },
      "title": "Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108266",
    "datePublished": "2026-10-09T21:00:19.595Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T21:00:19.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108265 (GCVE-0-2026-108265)

Vulnerability from cvelistv5 – Published: 2026-10-09 20:55 – Updated: 2026-10-09 20:55

Title

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

Summary

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Privasys/enclave-os-mini/secur…	x_refsource_CONFIRM
https://github.com/Privasys/enclave-os-mini/commi…	x_refsource_MISC
https://github.com/Privasys/enclave-os-mini/relea…	x_refsource_MISC
https://privasys.org/blog/binding-attestation-to-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Privasys	enclave-os-mini	Affected: < wasm-v0.40.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "enclave-os-mini",
          "vendor": "Privasys",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c wasm-v0.40.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime\u0027s RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T20:55:54.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e"
        },
        {
          "name": "https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0"
        },
        {
          "name": "https://privasys.org/blog/binding-attestation-to-the-tls-session",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://privasys.org/blog/binding-attestation-to-the-tls-session"
        }
      ],
      "source": {
        "advisory": "GHSA-49qm-4pj3-w2c6",
        "discovery": "UNKNOWN"
      },
      "title": "enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108265",
    "datePublished": "2026-10-09T20:55:54.705Z",
    "dateReserved": "2026-10-09T17:33:15.410Z",
    "dateUpdated": "2026-10-09T20:55:54.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities by Privasys

CVE-2026-108269 (GCVE-0-2026-108269)

CVE-2026-108268 (GCVE-0-2026-108268)

CVE-2026-108267 (GCVE-0-2026-108267)

CVE-2026-108266 (GCVE-0-2026-108266)

CVE-2026-108265 (GCVE-0-2026-108265)

CVE-2026-108269 (GCVE-0-2026-108269)

CVE-2026-108268 (GCVE-0-2026-108268)

CVE-2026-108267 (GCVE-0-2026-108267)

CVE-2026-108266 (GCVE-0-2026-108266)

CVE-2026-108265 (GCVE-0-2026-108265)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities by Privasys

CVE-2026-108269 (GCVE-0-2026-108269)

CVE-2026-108268 (GCVE-0-2026-108268)

CVE-2026-108267 (GCVE-0-2026-108267)

CVE-2026-108266 (GCVE-0-2026-108266)

CVE-2026-108265 (GCVE-0-2026-108265)

CVE-2026-108269 (GCVE-0-2026-108269)

CVE-2026-108268 (GCVE-0-2026-108268)

CVE-2026-108267 (GCVE-0-2026-108267)

CVE-2026-108266 (GCVE-0-2026-108266)

CVE-2026-108265 (GCVE-0-2026-108265)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.