Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-108362: Privasys RA‑TLS client can be tricked into trusting any TEE
CVE-2026-108362 · published today
Summary
The Privasys Remote Attestation TLS client library (versions before 0.11.0) will accept proof from any trusted secure enclave without checking that the enclave is the specific one expected. An attacker who can fake that proof or steal secrets from a legitimate enclave could pretend to be the original server and intercept or alter communications. Upgrade to version 0.11.0 or later to require explicit platform identification.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| privasys | ra-tls-clients | < 0.11.0 |
Original advisory text
Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.
Severity
9.1
Critical
Type
CWE-346Origin Validation Error
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta