Loading vulnerability…
TLS session-binding bypass in Remote Attestation TLS Clients
CVE-2026-108269 affects the Rust and Go RA-TLS challenge verifiers in Remote Attestation TLS Clients before version 0.5.0. The verifiers accept attestation quote ReportData bound to the certificate public key and client nonce without verifying that it is bound to the active TLS session before allowing application traffic. An attacker possessing an enclave TLS private key can relay a genuine quote onto a different connection, causing a client to accept an attacker-terminated TLS connection as the attested enclave.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses the binding between enclave attestation and the active TLS connection. Clients consequently trust an attacker-terminated connection as the attested enclave and permit application traffic over it, compromising endpoint authentication and exposing that traffic to the attacker rather than exclusively to the enclave.
Patch, then assume compromise.
Upgrade Remote Attestation TLS Clients to version 0.5.0, which fixes the vulnerability in the Rust and Go RA-TLS challenge verifiers.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.