Key points
- CVE-2026-108362 is rated Critical with a CVSS score of 9.1.
- The bug allowed verifiers to accept attestation evidence from unauthorised TEE platforms.
- Privasys released version 0.11.0 to fix the vulnerability in ra-tls-clients.
Privasys has released version 0.11.0 of its ra-tls-clients software to address a critical security flaw. The vulnerability, tracked as CVE-2026-108362, allows attackers to impersonate secure endpoints. This issue affects all versions prior to the latest release and poses a significant risk to systems relying on remote attestation for trust.
In plain English
Remote attestation helps verify that a device is genuine before establishing a secure connection. In this case, the software failed to check the specific identity of the platform sending the proof. This meant that valid security measurements from one trusted device could be accepted as if they came from a different, intended device. Attackers could use this gap to pretend to be a legitimate endpoint, bypassing standard security checks.
The background
The National Vulnerability Database rates the issue as Critical with a CVSS score of 9.1. The flaw stems from CWE-346, which relates to origin verification errors. Before version 0.11.0, the Privasys Remote Attestation TLS Clients utilities accepted TEE attestation evidence without requiring an explicitly authorised platform identity. This lack of strict verification created a window for exploitation where network attackers could forge evidence or extract secrets from compromised platforms.
What changes now
Privasys has fixed this issue in version 0.11.0. The update ensures that verifiers correctly validate the platform identity associated with attestation evidence. Users running older versions of ra-tls-clients are exposed to the risk of endpoint impersonation. Upgrading to the patched version is necessary to restore proper security controls and prevent unauthorised access through forged attestation data.
What to do and how to stay safe: Privasys
- Identify all systems using Privasys ra-tls-clients versions older than 0.11.0.
- Plan an immediate upgrade to version 0.11.0 to close the attestation bypass gap.
- Monitor network logs for unusual connection patterns that might indicate impersonation attempts.
- Review your remote attestation policies to ensure platform identities are strictly validated.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108362?
The vulnerability has a CVSS score of 9.1, which is rated as Critical severity.
Which versions of ra-tls-clients are affected?
All versions prior to 0.11.0 are affected by this security flaw.
Is there a fix available for this issue?
Yes, Privasys has released version 0.11.0 which fixes the attestation bypass vulnerability.
