Privasys rustls: Attestation not bound to TLS session (relay attack)
Summary
The Privasys fork of the rustls TLS library, used for RA-TLS remote attestation, produced challenge certificates whose attestation quote was not bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, so a relying party might accept an attacker-controlled connection as the attested enclave. The issue is relevant only where Privasys RA-TLS enclave software is used.
Affected
- Privasys rustls versions before privasys-v0.8.1
- Per the CNA record, the range is < privasys-v0.8.1; the GHSA lists <= privasys-v0.2.0 and privasys-v0.8.1. Whether intermediate tags are affected is unknown.
Fixed in
- Upgrade to privasys-v0.8.1 or later.
Workaround
- No workaround documented.
- Relying parties should verify the session channel binding, not only the quote, as described by the vendor.
Exploitation
- No reports of exploitation in the wild and no public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Exploitation requires the enclave TLS private key, which is hard to obtain because it is generated inside a TEE.
Our recommendation
- Check whether Privasys RA-TLS or enclave software is used in your environment. If not, no action is needed.
- If used, upgrade to privasys-v0.8.1 and rebuild enclave binaries; measurements will change, so plan this with the application owner.
- Confirm that relying parties use binding-aware verification.
- Consider rotating enclave TLS keys and re-attesting endpoints after the upgrade.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-j6qv-435v-r492 github.com
- Release privasys-v0.8.1 github.com
- Fix commit ab63058 github.com
- Privasys blog: Binding attestation to the TLS session privasys.org
- OSV entry CVE-2026-108266 osv.dev
- Ubuntu security CVE-2026-108266 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:04.
Original description (NVD)
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.