Threat Intelligence Database

CVE-2026-108361 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Privasys ra-tls-clients before version 0.9.1. The vulnerability allows an attacker with local access to modify workload code, data, and configuration on the TLS endpoint after the connection is established but before it is terminated. This occurs because attestation is performed only once at connection establishment, and the verifying peer assumes the state remains unchanged throughout the connection. The issue is fixed in version 0.9.1.

CVE-2026-108362 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.11.0. The vulnerability allows acceptance of TEE attestation evidence without verifying an explicitly authorized platform identity. This flaw enables a network attacker who can forge evidence or extract attestation secrets from a compromised but unrevoked platform to impersonate the attested TLS endpoint. The issue is resolved in version 0.11.0.

CVE-2026-108269 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.5.0. The Rust and Go RA-TLS challenge verifiers did not bind the quote ReportData to the active TLS session, allowing an attacker with the enclave TLS private key to relay a genuine quote onto another connection. This could cause clients to accept attacker-terminated connections as if they were attested enclaves. The issue is fixed in version 0.5.0.