Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112377updated 25 Oct 2026, 15:20 UTC

attested-tls-poc: attestation can be replayed to impersonate a workload

A flaw lets an attacker borrow a real, trusted proof that a server is genuine and reuse it to pose as that server. If the attacker also has the stolen private key for the connection, they can read and alter data meant for the real workload.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Key extractedAttacker obtains attested TLS private key
  2. 2Nonce forwardedRelying party's nonce sent to genuine attester
  3. 3Evidence replayedValid Evidence relayed back, not bound to connection
  4. 4Workload impersonatedAttacker poses as attested workload
  5. 5Data interceptedTraffic meant for workload is captured
  6. ResultAttacker impersonates workload and intercepts data

What happened

In CCC Attestation SIG attested-tls-poc through commit 731ca82, early attestation Evidence is not bound to the TLS connection, so valid Evidence from a genuine attester can be relayed and replayed by an attacker holding an extracted attested TLS private key.

Why it is dangerous: An attacker can impersonate the attested workload and intercept the data sent to it, defeating the trust that attestation is meant to provide.

Are you affected?

You are affected if you run or depend on attested-tls-poc at or before commit 731ca82.

attested-tls-poc through commit 731ca82

What to do

  1. Check whether you use attested-tls-poc and whether your code is at or before commit 731ca82
  2. Protect attested TLS private keys so they cannot be extracted
  3. Watch the project advisory (GHSA-hqrh-qq2r-6h96) for a fixed version and update when one is published

Timeline

  1. 19 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 19 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112377 · GHSA-hqrh-qq2r-6h96
CVSS
9.1 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
19 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

attested-tls-poc: attestation can be replayed to impersonate a workload · Zero Radar