CVE-2026-108362— Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
Quick assessment
Affected
Privasys ra-tls-clients
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Privasys 远程证明 TLS 客户端提供多语言工具，用于验证经过证明的 TLS 连接。在版本 0.11.0 之前，Privasys 证明型 TLS 中的可信执行环境（TEE）证明证据在未被要求提供明确授权的平台身份的情况下即被接受。当网络攻击者能够伪造证明证据，或从已遭入侵但未被撤销的平台上提取证明密钥时，验证器会将来自另一台未被撤销的 TEE 平台的有效测量值，误认为其源自预期的证明方（Attester）。攻击者可借此冒充经过证明的 TLS 端点。该问题已在版本 0.11.0 中得到修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Privasys | ra-tls-clients | < 0.11.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108362
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
Source: CVE Program / CVE List V5
Vulnerability Description
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Privasys | ra-tls-clients | < 0.11.0 | - |
|
II. Public POCs for CVE-2026-108362
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108362
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108362 (1)
Vendor Pages for CVE-2026-108362 (1)
-
🔗 Release v0.11.0 · Privasys/ra-tls-clients · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: Privasys
-
CVE-2026-108361
Privasys Intra-handshake attested TLS implementation is vuln -
CVE-2026-108269
ra-tls-clients: RA-TLS challenge verifier accepted quotes no -
CVE-2026-108268
enclave-os-virtual: RA-TLS challenge certificates were not b -
CVE-2026-108267
Privasys Go fork: RA-TLS challenge mode did not bind attesta -
CVE-2026-108266
Privasys rustls fork: RA-TLS challenge mode did not bind att
Same weakness: CWE-346
-
CVE-2026-97381
Legacy Update ActiveX control accepts unauthorized hosting o -
CVE-2026-96234
.NET Information Disclosure Vulnerability -
CVE-2026-96238
.NET Security Feature Bypass Vulnerability -
CVE-2026-88132
Azure Key Vault Information Disclosure Vulnerability -
CVE-2026-70213
Microsoft Power Apps Remote Code Execution Vulnerability
V. Comments for CVE-2026-108362
No comments yet