TLS session vulnerability in Enclave OS Mini by PrivaSys

CVE-2026-108265

What is CVE-2026-108265?

Prior to the release of wasm-v0.40.0, Enclave OS Mini contained a vulnerability related to TLS session management. The SGX runtime failed to properly bind attestation data to the active TLS session, allowing an attacker to exploit this flaw. If an attacker were to acquire an enclave's TLS private key, they could relay a legitimate attestation quote to establish an unauthorized connection. This could mislead a relying party, resulting in acceptance of a connection that appears to be from a valid enclave. This vulnerability has been addressed in version wasm-v0.40.0.

References