CVE-2026-11836— Production Debug-Unlock Token Verification Missing Device Binding
Possible ATT&CK Techniques 1AI
T1610 · Deploy ContainerAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Caliptra | Core Firmware | 2.0.0≤ 2.0.1 | affected |
2.0.2 | unaffected | ||
2.1.0 | affected | ||
2.1.1 | unaffected | ||
| Caliptra | Core ROM | 2.0.0≤ 2.0.2 | affected |
2.0.3 | unaffected | ||
2.1.0≤ 2.1.1 | affected | ||
2.1.2 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11836
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Production Debug-Unlock Token Verification Missing Device Binding
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Vulnerability Title
CHIPS Alliance Core ROM 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CHIPS Alliance Core ROM是CHIPS Alliance组织的一款只读存储器核心。 CHIPS Alliance Core ROM 2.0.0版本至2.0.2版本、2.1.0版本至2.1.1版本和Caliptra Core Firmware 2.0.0版本至2.0.1版本、2.1.0版本存在输入验证错误漏洞，该漏洞源于对数据真实性验证不足（validate_debug_unlock_token()），可能导致能够访问集成商调试解锁签名服务的攻击者通过提供针对不同设备但共享相同调试解锁密
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Caliptra | Core ROM | 2.0.0 ~ 2.0.2 | - | |
| Caliptra | Core Firmware | 2.0.0 ~ 2.0.1 | - |
II. Public POCs for CVE-2026-11836
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11836
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11836 (1)
IV. Related Vulnerabilities
Same vendor: Caliptra
Same weakness: CWE-345
- CVE-2026-68554
Coturn: STUN attributes after MESSAGE-INTEGRITY are processe - CVE-2026-76245
stigmem Federation Peer Token Timestamp Validation Bypass - CVE-2026-52737
ZEBRA: Sync restart poisoning from single unauthenticated pe - CVE-2026-18674
Kong Mesh multi-zone: the global control plane attributes KD - CVE-2026-74890
openssl_encrypt before 1.4.0 HMAC Authentication Bypass via
V. Comments for CVE-2026-11836
No comments yet