# CVE-2026-108268: Enclave OS Virtual RA-TLS quote relay in attestation

Source: https://junglewise.ai/threats/cve-2026-108268-enclave-os-virtual-runs-container-workloads-inside-confidential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108268 · Severity: info · Published 2026-10-09

Enclave OS Virtual is a system that runs container workloads inside secure Intel TDX virtual machines with attestation mechanisms to verify their authenticity. An attacker who obtained a TLS private key from an enclave could forge attestation quotes and trick relying parties into accepting forged connections as legitimate, potentially exposing sensitive data or enabling man-in-the-middle attacks on encrypted communications.

Vendors: [Privasys](https://junglewise.ai/threats/vendors/privasys).

## Quick answers

**Is CVE-2026-108268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108268 being exploited in the wild.

**How severe is CVE-2026-108268?** Informational severity, published 9 October 2026.

**Which products and versions are affected?** Privasys Enclave OS Virtual before tdx-v0.2.43 and tdx-gpu-v0.6.27.

**Is there a fix for CVE-2026-108268?** Yes: fixed in tdx-v0.2.43, tdx-gpu-v0.6.27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108268 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-108268?** Check whether you run Privasys Enclave OS Virtual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in tdx-v0.2.43, tdx-gpu-v0.6.27

## Technical details

A flaw in the RA-TLS (Remote Attestation TLS) certificate issuer's quote generation failed to bind the attestation quote to the active TLS session; the ReportData field contained only the certificate public-key hash and client nonce, omitting the TLS session channel binder. An attacker with an enclave's TLS private key could relay a genuine attestation quote to another connection, bypassing session binding verification. The fix adds channel-binding material to the quote's report_data field, causing replayed quotes to fail binder validation.

## Affected products

- Privasys Enclave OS Virtual before tdx-v0.2.43 and tdx-gpu-v0.6.27

## Timeline

- 2026-10-09: disclosed

## References

- [https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347](https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347)
- [https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27](https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27)