Quick answers
- Is CVE-2026-108269 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-108269 being exploited in the wild.
- How severe is CVE-2026-108269?
- Informational severity, published 9 October 2026.
- Which products and versions are affected?
- Privasys Remote Attestation TLS Clients before 0.5.0.
- Is there a fix for CVE-2026-108269?
- Yes: fixed in 0.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-108269 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-108269?
- Check whether you run Privasys Remote Attestation TLS Clients at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.5.0
Technical details
The Rust and Go RA-TLS challenge verifiers failed to validate that attestation quote ReportData was bound to the specific TLS session via channel binder, checking only the certificate public key and client nonce. An attacker possessing an enclave TLS private key could relay a legitimate quote from one session to another, bypassing session-level authenticity checks and causing clients to accept attacker-terminated connections as genuinely attested. The fix (v0.5.0) now requires the TLS channel binder derived from the handshake key schedule to be included in report_data verification.
Affected products
- Privasys Remote Attestation TLS Clients before 0.5.0
Timeline
- 2026-10-09: disclosed
- 2026-07-10: patched