Threat Intelligence Database

CVE-2026-11836 is a vulnerability in Caliptra Core ROM and Core Firmware where insufficient verification of data authenticity in the debug unlock token validation allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on unintended devices sharing the same debug unlock key hash. The vulnerability affects Core ROM versions 2.0.0 through 2.0.2 and 2.1.0 through 2.1.1, and Core Firmware versions 2.0.0 through 2.0.1 and 2.1.0. The 384-bit challenge nonce prevents replay attacks, limiting the impact to loss of per-device scope enforcement within a set of devices sharing the same unlock authority. This does not enable debug unlock on devices outside that set. The CVSS 4.0 base score is 1.8, indicating low severity.

CVE-2026-11835 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Caliptra Core ROM versions 2.1.0 through 2.1.1. It allows a compromised local attacker with high privileges to bypass secure boot by supplying an unvalidated AXI staging address, enabling modification of firmware between verification and loading. The attestation process continues to report the original verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM accessible by Caliptra.