Threat database

CVE-2026-108361 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Privasys ra-tls-clients before version 0.9.1. The vulnerability allows a local attacker to modify workload code, data, and configuration on the TLS endpoint after the connection is established but before it is terminated. This occurs because attestation is only performed once at connection establishment, and the verifying peer assumes the attested state remains unchanged during the connection lifetime. This flaw is fixed in version 0.9.1.

CVE-2026-108362 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.11.0. The vulnerability allows acceptance of TEE attestation evidence without verifying an explicitly authorized platform identity. This flaw enables an attacker who can forge evidence or extract attestation secrets from a compromised but unrevoked platform to impersonate the attested TLS endpoint. The issue is fixed in version 0.11.0.

CVE-2026-108269 is a critical origin validation error in Privasys ra-tls-clients prior to version 0.5.0. The vulnerability involves the Rust and Go RA-TLS challenge verifiers accepting attestation quotes that are bound to the certificate public key and client nonce but not to the active TLS session. This flaw allows an attacker who has obtained an enclave TLS private key to relay a genuine quote onto a different connection, causing the client to mistakenly accept an attacker-terminated connection as a valid attested enclave. The issue is fixed in version 0.5.0.

CVE-2026-108268 is an origin validation error in Privasys enclave-os-virtual affecting versions prior to tdx-v0.2.43 and tdx-gpu-v0.6.27. The vulnerability involves the TDX/GPU RA-TLS certificate issuer omitting a value bound to the active TLS session in the quote ReportData, allowing an attacker with the enclave TLS private key to relay a genuine quote onto another connection. This could cause a relying party to accept an attacker-terminated connection as if it were the attested enclave. The issue is fixed in versions tdx-v0.2.43 and tdx-gpu-v0.6.27.

CVE-2026-108267 is an origin validation error in Privasys Go, a fork of the Go programming language with RA-TLS support. Before version 0.5.1-go1.26.5, the RA-TLS certificates in challenge mode did not bind the quote ReportData to the active TLS session, allowing an attacker with an enclave TLS private key to relay a genuine quote onto another connection. This could cause a relying party to mistakenly accept a handshake as an attested enclave connection. The issue is fixed in version 0.5.1-go1.26.5.

CVE-2026-108266 is a critical origin validation error in the Privasys rustls library prior to version 0.8.1. The vulnerability involves RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. This flaw allows an attacker with access to an enclave TLS private key to relay a genuine quote onto another connection, causing a relying party to mistakenly accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in Privasys rustls version 0.8.1.

CVE-2026-108265 is a critical origin validation error in Privasys enclave-os-mini, a Rust-based runtime for Intel SGX enclaves. Before version 0.40.0, the SGX runtime's RA-TLS challenge certificate path omitted a value bound to the active TLS session, allowing an attacker with the enclave TLS private key to relay a genuine quote onto another connection. This could cause a relying party to mistakenly accept an attacker-terminated connection as if it were from the attested enclave. The issue is fixed in version 0.40.0.