CVE-2026-108267 Details
Description
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.
A vulnerability exists in Privasys Go, a fork of the Go programming language, in versions prior to privasys-v0.5.1-go1.26.5. The issue arises in the RA-TLS challenge mode, where attestation quotes were not properly bound to the active TLS session. Instead, the quotes only referenced the certificate's public key and client nonce, leaving a gap that could be exploited. An attacker with access to an enclave's TLS private key could relay a genuine quote from one connection to another, misleading a relying party into believing they were engaged in a secure, attested handshake with the enclave.
Users can upgrade to Privasys Go version 0.5.1-go1.26.5, which addresses this vulnerability by implementing a channel binding mechanism that ties the attestation quote to the specific TLS session, preventing the relay attack.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Privasys/go/commit/00a7d21ba53bba0ea09ac7a67eb2c6714e651700 | [email protected] | Source CodeVendor |
| https://github.com/Privasys/go/releases/tag/privasys-v0.5.1-go1.26.5 | [email protected] | Release NotesVendor |
| https://github.com/Privasys/go/security/advisories/GHSA-7jfw-53rm-phh2 | [email protected] | AdvisoryRemedyVendor |
| https://privasys.org/blog/binding-attestation-to-the-tls-session | [email protected] | Technical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Privasys Go | <= privasys-v0.3.0-go1.26.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |