EUVD Vulnerability Catalog

EUVD-2026-96019

Severity: CRITICAL Base Score: 9.1 CVSS Version: 4.0

Vulnerability Description

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network
▪ Attack Complexity (AC): High
▪ Attack Requirements (AT): Present
▪ Privileges Required (PR): None
▪ User Interaction (UI): None
▪ Vulnerability Confidentiality Impact (VC): High
▪ Vulnerability Integrity Impact (VI): High
▪ Vulnerability Availability Impact (VA): None
▪ Subsequent Confidentiality Impact (SC): None
▪ Subsequent Integrity Impact (SI): None
▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor Privasys

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

GitHub_M

EPSS Probability

0

Known Aliases
CVE-2026-108269
Published On

2026-10-09

Last Updated

2026-10-09