Privasys Go fork: Missing session binding of RA-TLS attestation quotes
Summary
The Privasys Go fork, a Go toolchain extension for RA-TLS in crypto/tls, did not bind attestation quotes in challenge mode to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection. A relying party could then accept an attacker-terminated handshake as an attested enclave connection.
Affected
- Privasys Go before privasys-v0.5.1-go1.26.5
- According to the vendor advisory, releases up to privasys-v0.3.0-go1.26.5 are affected; the status of releases between v0.3.0 and v0.5.1 is unknown.
Fixed in
- privasys-v0.5.1-go1.26.5 (released 10 July 2026)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- Exploitation requires the enclave TLS private key; the vendor states that obtaining it requires defeating the memory isolation of a TEE.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether Privasys Go is used in your software, build manifests or lockfiles; if not, no action is needed beyond this inventory check.
- If it is used, upgrade to privasys-v0.5.1-go1.26.5 with priority.
- Plan attestation policy updates alongside the upgrade, because rebuilt enclaves get different measurements.
- Monitor the vendor advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Privasys Go security advisory GHSA-7jfw-53rm-phh2 github.com
- Privasys Go release privasys-v0.5.1-go1.26.5 github.com
- Fix commit 00a7d21 github.com
- Privasys blog: Binding attestation to the TLS session privasys.org
- OSV entry CVE-2026-108267 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:03.
Original description (NVD)
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.