CVE-2026-108362: Privasys Remote Attestation TLS Clients: attested TLS accepts evidence from unauthorized TEE platform (CWE-346)
CVE-2026-108362 affects Privasys Ra-tls-clients before version 0.11.0. According to the record, the verifier does not require an explicitly authorized platform identity for TEE attestation evidence, so measurements from a different unrevoked TEE platform may be accepted as coming from the intended Attester. The vendor advisory states the issue is fixed in version 0.11.0.
Overview
Privasys Ra-tls-clients is a set of multi-language utilities for verifying attested TLS connections based on Trusted Execution Environment (TEE) evidence. CVE-2026-108362 is classified as CWE-346 (Origin Validation Error). The record indicates that the verifier does not enforce an explicitly authorized platform identity when accepting TEE attestation evidence.
Impact
- The record describes a diversion scenario: measurements from a different unrevoked TEE platform may be accepted as if they came from the intended Attester.
- Per the description, an attacker positioned on the network may impersonate the attested TLS endpoint, provided they can forge evidence or extract attestation secrets from a compromised unrevoked platform.
- The CVSS 4.0 base score recorded is 9.1 (critical), with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The SSVC record lists automatable as no and technical impact as total.
Affected products and versions
- Privasys Ra-tls-clients, versions prior to 0.11.0 (record shows version < 0.11.0).
- The record contains an empty fixes list; the fix version 0.11.0 is stated in the description and referenced release page.
Exploitation status
The CISA KEV catalog does not list this CVE, so active exploitation is not confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS probability recorded is 0.00159 (percentile 0.04475), dated 2026-10-13.
Remediation and mitigation
- Upgrade Privasys Ra-tls-clients to version 0.11.0 or later, as indicated by the vendor references.
- Review the vendor security advisory and the release notes for upgrade details.
- Until upgraded, operators should review which attestation verifiers and platform identities are trusted, and limit trust to explicitly known and revoked-status-checked TEE platforms, as a defensive measure.
Detection guidance
- Inventory deployments that use Privasys Ra-tls-clients and record the installed version.
- Review verifier logs for attestation acceptances from platform identities that were not explicitly configured by the operator.
- Monitor for unexpected changes in the endpoints or platforms presenting attested TLS certificates.
Limitations of the available information
- The record does not state the specific language bindings or components affected beyond the product name.
- The record does not include details of the exact forgery or secret-extraction technique, and this analysis does not provide them.
- The CWE name field is empty in the record; the CWE-346 classification is taken from the identifier.
- No additional fixed-version commit details beyond the referenced commit are available in the record.
Frequently asked questions
What is the core problem in CVE-2026-108362?
According to the record, the verifier accepts TEE attestation evidence without requiring an explicitly authorized platform identity, which can let measurements from a different unrevoked TEE platform be accepted as coming from the intended Attester.
Which version fixes it?
The description and the referenced release page indicate that version 0.11.0 contains the fix. The record's fixes list is empty, so the release page is the main source.
Is this CVE known to be actively exploited?
No. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.