Threats affecting pkg:github/Core Firmware

CVE-2026-11836 is a low-severity vulnerability in Caliptra Core ROM and Core Firmware that involves insufficient verification of data authenticity in the validate_debug_unlock_token() function. An attacker with access to the integrator's debug unlock signing service can unlock production debug on unintended devices within a set sharing the same debug unlock key hash. The vulnerability does not allow unlocking devices outside this set due to a 384-bit challenge nonce that prevents replay attacks. Affected versions include Core ROM 2.0.0 through 2.0.2 and 2.1.0 through 2.1.1, and Core Firmware 2.0.0 through 2.0.1 and 2.1.0. No patch or official remediation is currently documented.