{"vulnerability": "CVE-2026-108265", "sightings": [{"uuid": "1faba8ca-19f8-4b2b-90fe-c563d2371c23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108265", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412963225518174", "content": "CVE-2026-108265 enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108265https://github.com/Privasys/enclave-os-mini/security/advisories/GHSA-49qm-4pj3-w2c6https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8ehttps://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0https://privasys.org/blog/binding-attestation-to-the-tls-session#Privasys #enclave-os-mini#CVE_2026_108265#bot", "creation_timestamp": "2026-10-09T21:00:39.783938Z"}, {"uuid": "2dcbd259-77b1-4533-affb-1f35e6e54326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108265", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhye3i5sf2w", "content": "\ud83d\udea8 CVE-2026-108265 \u2014 CVSS 9.1 CRITICAL\n\nEnclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to w...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108265\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:48.199836Z"}, {"uuid": "7d2f87a5-57db-405c-b230-4b466329eaf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108265", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxiby5arip24", "content": "CVE-2026-108265 - enclave-os-mini\nEnclave OS Mini runs confidential code inside Intel SGX. If an attacker gets the TLS private key, they can reuse a trusted quote on a different connection, making a server think it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:00:05.055773Z"}]}