Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-108266: privasys rustls could let attacker reuse attestation on other connections
CVE-2026-108266 · published 1 day ago
Summary
The privasys rustls library, used to secure communications, could allow a stolen private key to be used on a different connection, making it appear as a trusted enclave. This could let an attacker trick systems into thinking they are talking to a verified component. Updating to version 0.8.1 resolves the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| privasys | rustls | < privasys-v0.8.1 |
Original advisory text
Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.
References
- https://github.com/Privasys/rustls/security/advisories/GHSA-j6qv-435v-r492 Vendor Advisory
- https://github.com/Privasys/rustls/commit/ab630583b58fee84260cbbfe2f4a8b45d8bde2... Patch
- https://github.com/Privasys/rustls/releases/tag/privasys-v0.8.1 URL
- https://privasys.org/blog/binding-attestation-to-the-tls-session Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1082... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-108266 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
8.6
High
Type
CWE-346Origin Validation Error
Timeline
Published9 Oct 2026
Updated10 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-108266 · NVD
CVE-2026-108266 · MITRE
CVE-2026-108266 · OSV
GHSA-j6qv-435v-r492 · GHSA
Track software like this
Free during beta