CVE-2026-112377: CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.
Affected Software
Event History
Frequently Asked Questions
What must an attacker have before this attack is feasible?
The attacker must possess an extracted attested TLS private key and be able to relay the relying party's nonce to a genuine attester. The high attack complexity rating reflects these prerequisites.
Does exploitation require credentials or user interaction?
No privileges and no user interaction are required, according to the CVSS vector. However, the attacker still needs the extracted attested TLS private key and access to a genuine attester for the relay.
What is the practical impact of a successful relay?
An attacker can impersonate the attested workload by replaying valid Evidence from a genuine attester. This can allow interception of data, with high confidentiality and integrity impact.