Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

privasys RA‑TLS client could trust false connections

CVE-2026-108269 · published 1 day ago
Summary

Versions of privasys RA‑TLS client before 0.5.0 could be fooled into accepting a connection that isn’t the genuine secure enclave if an attacker steals the enclave’s TLS private key. The client would treat the hijacked link as trusted, letting the attacker see or alter data. Update to version 0.5.0 or later to close this gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
privasys ra-tls-clients < 0.5.0
Original advisory text
ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.
References
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published9 Oct 2026
Updated11 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-108269 · NVD
CVE-2026-108269 · MITRE
CVE-2026-108269 · OSV
GHSA-5qrc-v874-mxvx · GHSA
Track software like this
Free during beta