# CVE-2026-108265: Enclave OS Mini RA-TLS quote relay in SGX enclaves

Source: https://junglewise.ai/threats/cve-2026-108265-enclave-os-mini-is-a-rust-based-runtime-for-confidential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108265 · Severity: info · Published 2026-10-09

Enclave OS Mini is a Rust-based runtime that allows applications to run securely inside Intel SGX enclaves, which are isolated processing environments used for sensitive computations. A flaw in its TLS certificate validation allowed an attacker who obtained a TLS private key to replay a legitimate security proof (quote) to fake a connection as the attested enclave, bypassing the intended security guarantees. This could allow an attacker to impersonate a secure enclave to systems relying on its attestation.

Vendors: [Privasys](https://junglewise.ai/threats/vendors/privasys).

## Quick answers

**Is CVE-2026-108265 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108265 being exploited in the wild.

**How severe is CVE-2026-108265?** Informational severity, published 9 October 2026.

**Which products and versions are affected?** Privasys Enclave OS Mini before wasm-v0.40.0.

**Is there a fix for CVE-2026-108265?** Yes: fixed in wasm-v0.40.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108265 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108265?** Check whether you run Privasys Enclave OS Mini at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in wasm-v0.40.0

## Technical details

The RA-TLS challenge certificate path failed to include a session-binding value in the SGX quote's ReportData field, only including the certificate public-key hash and client nonce. An attacker who obtained the enclave's TLS private key could relay a genuine quote to a different connection, causing a relying party to accept an attacker-controlled TLS termination as coming from the attested enclave. The fix adds channel binding by committing a 32-byte binder derived from the TLS handshake key schedule to the quote's ReportData, verified post-handshake by the verifier.

## Affected products

- Privasys Enclave OS Mini before wasm-v0.40.0

## Timeline

- 2026-07-10: patched: Fix commit implementing channel binding
- 2026-10-09: advisory
- 2026-10-09: disclosed

## References

- [https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e](https://github.com/Privasys/enclave-os-mini/commit/9f541c849ef733d2df2851a666f359d01dcdcb8e)
- [https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0](https://github.com/Privasys/enclave-os-mini/releases/tag/wasm-v0.40.0)