Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Privasys Go could let attacker spoof trusted TLS session

CVE-2026-108267 · published 1 day ago
Summary

The Privasys Go software, which adds special security checks to Go’s TLS library, did not link the proof of a secure enclave to the actual network session in versions before v0.5.1-go1.26.5. This means that if an attacker obtains the private key used by the enclave, they could reuse a valid proof on a different connection, making the other side think it is talking to a trusted enclave. Upgrade to version v0.5.1-go1.26.5 or later to resolve the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
privasys go < privasys-v0.5.1-go1.26.5
Original advisory text
Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.
References
Severity
8.6 High
Type
CWE-346Origin Validation Error
Timeline
Published9 Oct 2026
Updated11 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-108267 · NVD
CVE-2026-108267 · MITRE
CVE-2026-108267 · OSV
GHSA-7jfw-53rm-phh2 · GHSA
Track software like this
Free during beta