Is CVE-2026-108267 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108267 being exploited in the wild.

How severe is CVE-2026-108267?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Privasys Go prior to privasys-v0.5.1-go1.26.5.

Is there a fix for CVE-2026-108267?

Yes: fixed in privasys-v0.5.1-go1.26.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108267 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108267?

Check whether you run Privasys Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108267: Privasys Go RA-TLS session relay vulnerability in crypto/tls

CVE-2026-108267 · Severity: info · Published 2026-10-09

Privasys Go is a fork of the Go programming language that adds Remote Attestation TLS support for secure enclave communications. Prior to version 0.5.1-go1.26.5, an attacker who obtained an enclave's TLS private key could replay an attestation proof onto a different connection, causing the relying party to incorrectly accept the attacker as a legitimate enclave. This breaks the security guarantees of remote attestation in trusted execution environments.

Vendors: Privasys.

Quick answers

Is CVE-2026-108267 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108267 being exploited in the wild.
How severe is CVE-2026-108267?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Privasys Go prior to privasys-v0.5.1-go1.26.5.
Is there a fix for CVE-2026-108267?: Yes: fixed in privasys-v0.5.1-go1.26.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108267 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108267?: Check whether you run Privasys Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: privasys-v0.5.1-go1.26.5

Technical details

The vulnerability is a session relay attack in RA-TLS challenge-mode certificate handling: attestation quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session, allowing quote reuse across connections. An attacker with an enclave private key could replay a genuine quote onto another TLS connection. The fix adds HKDF-derived session channel binding from the TLS 1.3 key schedule to prevent relay attacks; the binder is committed to in attestation quotes and must match the live session.

Affected products

Privasys Go prior to privasys-v0.5.1-go1.26.5

Timeline

2026-10-09: disclosed
2026-07-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.