Impersonation Vulnerability in Privasys Remote Attestation TLS Clients
CVE-2026-108362

9.1CRITICAL

Key Information:

Vendor

Privasys

Status
Ra-tls-clients
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108362?

The Privasys Remote Attestation TLS Clients previously accepted attestation evidence without verifying platform identities, allowing network attackers to forge evidence or extract secrets to impersonate the legitimate endpoint. This oversight exposed users to significant security risks by accepting measurements from unauthorized platforms. The issue has been addressed in version 0.11.0, reinforcing the need for explicit identity verification in attestation processes.

Affected Version(s)

ra-tls-clients < 0.11.0

References

https://github.com/Privasys/ra-tls-clients/security/advis...
x_refsource_CONFIRM
https://github.com/Privasys/ra-tls-clients/commit/1179ed0...
x_refsource_MISC
https://github.com/Privasys/ra-tls-clients/releases/tag/v...
x_refsource_MISC

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.