CVE-2026-112377 Details
Description
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.
A relay attack vulnerability has been identified in the CCC Attestation SIG's attested TLS proof-of-concept, specifically in the version prior to commit 731ca82. This vulnerability arises because the implementation fails to properly bind early attestation evidence to the TLS connection. As a result, attackers can intercept and replay valid evidence from a genuine attester to impersonate the attested workload and potentially access intercepted data. The vulnerability is exacerbated for attackers who possess an extracted private key from the attested TLS implementation.
Users are advised to update to a version of the CCC Attestation SIG attested TLS implementation that has addressed this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CCC Attestation SIG attested-tls-poc | <= 731ca82ed533fc7a1092be980887ae2e34261da2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |