TLS Session Vulnerability in Enclave OS Virtual by Privasys
CVE-2026-108268
9.1CRITICAL
What is CVE-2026-108268?
A vulnerability in Enclave OS Virtual allows an attacker to exploit the TLS session binding mechanism. Prior to the updates tdx-v0.2.43 and tdx-gpu-v0.6.27, the certificate issuer improperly handled the public-key hash and client nonce in the quote ReportData, avoiding a required value linked to the active TLS session. This flaw could let an attacker use a valid enclave TLS private key to intercept and relay a quote, tricking a relying party into accepting a connection as authentic when it was actually terminated by the attacker. Users are urged to update to the latest versions to mitigate this risk.
Affected Version(s)
enclave-os-virtual < tdx-v0.2.43 < tdx-v0.2.43
enclave-os-virtual < tdx-gpu-v0.6.27 < tdx-gpu-v0.6.27