Executive brief
OpenNHP is an open-source toolkit used to enforce Zero Trust security for infrastructure and applications. A vulnerability in versions through 1.0.2 allows attackers to bypass attestation verification—a critical security check that confirms code integrity—by injecting a test_purpose key into attestation evidence. This enables unauthorized access to systems that should be protected by trusted-execution verification.
Technical details
The vulnerability exists in the verifier selection logic (NewVerifier function in verifier.go). When processing attestation evidence, the code checks for the presence of a "test_purpose" key in the JSON evidence object. If this key is present, the system instantiates a FallbackVerifier that unconditionally returns nil from its Verify() method, effectively skipping all attestation checks. An attacker can exploit this by crafting malicious evidence containing the test_purpose key along with valid enrolled measure and serial number pairs from the allowlist. The attack requires the attacker to know valid measure/serial number combinations but requires no authentication or special network position. The fix involves removing the test_purpose-based fallback path or implementing proper access controls around it.
Affected products
- OpenNHP OpenNHP through 1.0.2
Timeline
- 2026-09-16: disclosed