CCC attested-tls-poc: Attestation relay attack due to missing TLS binding
Summary
The proof-of-concept attested-tls-poc up to commit 731ca82 does not bind early attestation Evidence to the TLS connection. An attacker who holds an extracted attested TLS private key can forward the relying party's nonce to a genuine attester, replay the returned Evidence and impersonate the attested workload to intercept data. The project is a research prototype that its maintainers have declared defunct and insecure.
Affected
- CCC-Attestation attested-tls-poc through commit 731ca82ed533fc7a1092be980887ae2e34261da2
- Default configuration is unaffected according to the CVE record
Fixed in
Unknown.
Workaround
- No official workaround known.
- The weakness lies in the protocol binding, not in a configuration setting.
- The maintainers advise against using this codebase.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in CISA KEV
- No verified in-the-wild exploitation found
Our recommendation
- Check whether any internal or vendor-supplied software uses attested-tls-poc or intra-handshake attestation.
- Do not deploy this codebase.
- If intra-handshake attested TLS is in use, treat it as relay-vulnerable and plan a migration to attestation after the TLS handshake.
- Monitor the project and the vendor advisories for a fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- attested-tls-poc GitHub repository github.com
- ProVerif formal artifacts (relay-attacks-formal) github.com
- IETF draft draft-intra-handshake-fail-58 datatracker.ietf.org
- The Register: Confidential computing trust mechanism broken www.theregister.com
- Strix CVE record CVE-2026-112377 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:21.
Original description (NVD)
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.
NVD references (7)
- https://datatracker.ietf.org/doc/draft-intra-handshake-fail/
- https://github.com/CCC-Attestation/attested-tls-poc
- https://github.com/CCC-Attestation/attested-tls-poc/pull/58
- https://github.com/CCC-Attestation/attested-tls-poc/tree/5b6c5374b3fe8b671906c8ab32f6134d9c3da26d/relay-attac…
- https://github.com/ionut-arm/mbedtls/blob/f4ac7593826a506fc509c83cad73786acab1d442/library/ssl_tls13_generic.…
- https://github.com/muhammad-usama-sardar/intra-handshake.fail
- https://www.vulncheck.com/advisories/ccc-attestation-sig-attested-tls-poc-through-commit-731ca82-attestation-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.