CVE-2026-108362: CWE-346: Origin Validation Error in Privasys ra-tls-clients
Description
CVE-2026-108362 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.11.0. The vulnerability allows acceptance of TEE attestation evidence without verifying an explicitly authorized platform identity. This flaw enables a network attacker who can forge evidence or extract attestation secrets from a compromised but unrevoked platform to impersonate the attested TLS endpoint. The issue is resolved in version 0.11.0.
CVSS v4.0
Score 9.1critical
Affected software
Privasys
ra-tls-clients
pkg:github/privasys/ra-tls-clientsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Privasys Remote Attestation TLS Clients (ra-tls-clients) prior to version 0.11.0 do not require explicit authorization of platform identity when verifying TEE attestation evidence. This origin validation error (CWE-346) means that if an attacker can forge attestation evidence or extract secrets from a compromised unrevoked platform, the verifier will accept valid measurements from a different unrevoked TEE platform as if they originated from the intended attester. Consequently, the attacker can impersonate the attested TLS endpoint. The vulnerability has a CVSS 4.0 score of 9.1 (critical) and is fixed in version 0.11.0.
Potential Impact
An attacker capable of forging attestation evidence or extracting attestation secrets from a compromised but unrevoked platform can impersonate the attested TLS endpoint. This undermines the trust model of attested TLS connections, potentially allowing unauthorized access or man-in-the-middle attacks against systems relying on Privasys ra-tls-clients for secure attestation.
Mitigation Recommendations
Upgrade Privasys ra-tls-clients to version 0.11.0 or later, where this origin validation error is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 0.11.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-09T20:32:44.301Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd36282cdf04f656c89f30
Added to database: 10/12/2026, 19:34:00 UTC
Last enriched: 10/12/2026, 19:48:15 UTC
Last updated: 10/12/2026, 19:49:02 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.