Vulnerability · Published Oct 12, 2026 · Assigned by GitHub_M
CVE-2026-108361Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
High 7.2
In plain English
A high-severity security flaw in ra-tls-clients from Privasys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Official description
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Privasys | ra-tls-clients | < 0.9.1 |
Weakness: CWE-367 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-gg8q-mfhh-wrrc x_refsource_CONFIRM
- https://github.com/Privasys/ra-tls-clients/commit/076074873117ee5ff35a7c39e02952c28de3df0c x_refsource_MISC
- https://github.com/Privasys/ra-tls-clients/commit/5ccfd778132e17cb54bb1a9c7b89d57fcfea59ec x_refsource_MISC
- https://github.com/Privasys/ra-tls-clients/commit/b9114d772a636ad3307957dde4bb8afe70c9b40d x_refsource_MISC