CVE-2026-108362
Received Received - Intake

Privasys Remote Attestation TLS Clients TEE Attestation Bypass

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108362
EUVD
EUVD-2026-97781

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Privasys ra-tls-clients < 0.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Privasys Remote Attestation TLS Clients versions prior to 0.11.0. It allows a network attacker to impersonate a TLS endpoint being attested if they can forge attestation evidence or extract secrets from any unrevoked Trusted Execution Environment (TEE) platform globally. The software accepted valid attestation evidence without verifying the specific machine producing it, enabling impersonation of attested endpoints if even one compromised machine's certificate remains unrevoked.

Detection Guidance

Detecting this vulnerability requires checking if your Privasys ra-tls-clients version is below 0.11.0. Use commands like 'ra-tls-client --version' or inspect package managers (e.g., 'pip show ra-tls-clients' for Python). Verify if platform identity verification is enabled in your attestation server or client configuration.

Impact Analysis

If exploited, this vulnerability could allow an attacker to impersonate a legitimate TLS endpoint, potentially intercepting or manipulating sensitive communications. This could lead to unauthorized access to data, man-in-the-middle attacks, or other malicious activities depending on the context of the attested connection.

Compliance Impact

This vulnerability could undermine compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or sensitive data through impersonation attacks. Organizations using affected versions may face increased risks of data breaches, legal penalties, and reputational damage due to compromised attestation mechanisms.

Mitigation Strategies
  • Upgrade Privasys ra-tls-clients to version 0.11.0 or later to enable platform identity verification.
  • Configure an allow-list of permitted TEE platform IDs in your attestation server and clients.
  • Ensure your attestation server validates PCK certificate chains against Intel's revocation lists.
  • Monitor for unauthorized attestation evidence or unexpected platform identities in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart