Remote Attestation Vulnerability in Privasys TLS Clients

CVE-2026-108361

What is CVE-2026-108361?

The Privasys Remote Attestation TLS Clients before version 0.9.1 exhibit a significant security flaw that allows local attackers to manipulate workload code, data, and configuration after a successful TLS connection has been initiated. Once connected, there is a period during which the connection remains vulnerable, enabling malicious actions that alter the state of the workload and platform in real-time. This issue arises from the attestation mechanism, which verifies the connection only at the initial establishment, failing to account for any subsequent state changes. The vulnerability has been addressed in version 0.9.1.

References