CVE-2026-108269 Details
Description
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.
A vulnerability exists in the Rust and Go RA-TLS challenge verifiers within the Remote Attestation TLS Clients prior to version 0.5.0. The issue arises because these verifiers accepted quotes that were only bound to the certificate's public key and client nonce, but not to the active TLS session. This flaw allowed an attacker with access to an enclave's TLS private key to relay a legitimate quote onto a different connection, misleading the client into accepting an attacker-terminated connection as genuine. The vulnerability has been addressed in version 0.5.0 by requiring quotes to be bound to the TLS session before application traffic is allowed.
Users are advised to upgrade to Remote Attestation TLS Clients version 0.5.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Privasys/ra-tls-clients/commit/b8de9bcadd0f81ca8882d15095fc0d9c50e40148 | [email protected] | Source CodeVendor |
| https://github.com/Privasys/ra-tls-clients/releases/tag/v0.5.0 | [email protected] | Release NotesVendor |
| https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-5qrc-v874-mxvx | [email protected] | AdvisoryRemedyVendor |
| https://privasys.org/blog/binding-attestation-to-the-tls-session | [email protected] | Technical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Privasys RA-TLS Clients | <= v0.4.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |