Attestation TLS Relay Vulnerability in CCC Attestation SIG

Executive Summary

CVE-2026-112377 is a vulnerability in CCC Attestation SIG's attested-tls-poc implementation where early attestation evidence is not properly bound to the TLS connection. This allows attackers to relay valid attestation data from a genuine device to impersonate a workload. Attackers with a stolen attested TLS private key can forward a relying party's nonce to a real attester and replay its evidence, intercepting data by masquerading as the attested workload.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is specific to the CCC Attestation SIG attested-tls-poc implementation up to commit 731ca82. To detect it, check if your system uses this version or earlier. Inspect logs for relayed attestation evidence or unexpected nonce forwarding during TLS handshakes. Formal analysis tools like ProVerif can verify the binding mechanism, but this requires expertise.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to impersonate attested workloads, intercept sensitive data, or bypass authentication. If you use systems relying on attested-tls-poc up to commit 731ca82, your communications could be compromised. Attackers may gain unauthorized access to encrypted data or perform man-in-the-middle attacks, undermining trust in the attested TLS mechanism.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or interception, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust. Organizations using vulnerable implementations must address this flaw to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using the attested-tls-poc implementation up to commit 731ca82. Update to a patched version if available or migrate to alternative solutions like the IETF's SEAT Working Group recommendations. Monitor for unusual TLS handshake patterns or relayed attestation data.

Useful 0 Not Useful 0