CVE-2026-108362

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.

CVSS 4.0

9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-25)

CWE

CWE-346

Published

2026-10-12

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/Privasys/ra-tls-clients/commit/1179ed097fdcb8519a85973a8a6c6ccbd0f50b03
• https://github.com/Privasys/ra-tls-clients/releases/tag/v0.11.0
• https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-pj2x-5wqv-fh57

Check your stackJSON