How do I check whether I am affected by CVE-2026-112377?

Check whether you use or copied code from CCC-Attestation/attested-tls-poc (Docker recipes, its mbedtls fork, Veraison/Parsec components): run 'git log' or inspect your vendored commit and compare it to 731ca82ed533fc7a1092be980887ae2e34261da2. Any build at or before that commit is affected. Also check whether your own attested-TLS design signs only a nonce (and/or the server public key) in the Evidence without binding to the handshake.

What is the fix for CVE-2026-112377?

No fixed version or commit as of 2026-10-23; the repo is a proof-of-concept and is declared vulnerable. Do not use it in production. Mitigation: bind Evidence to the TLS session (for example via a TLS exporter value or handshake-transcript secret) as discussed in the intra-handshake.fail work, and protect or rotate attested-TLS private keys that may have been extracted.

Who is not affected by CVE-2026-112377?

Not affected if: does-not-use-attested-tls-poc, no-intra-handshake-attestation.

Live › vulnerability › CVE-2026-112377

Go to dashboard

critical9.1Package

attested-tls-poc: attestation evidence not bound to TLS, enabling relay impersonation

CCC Attestation SIG's attested-tls-poc, a demo of attestation inside the TLS handshake, does not bind early attestation Evidence to the TLS connection. An attacker with an extracted attested-TLS private key can relay the relying party's nonce to a genuine attester, replay its Evidence, impersonate the attested workload and intercept data. The maintainers marked the PoC as vulnerable and have not shipped a fix.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.1

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 19, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Attacker impersonates attested workload and intercepts its data.
CVSS said: 9.1. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-112377

Go to dashboard

critical9.1Package

attested-tls-poc: attestation evidence not bound to TLS, enabling relay impersonation

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.1

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 19, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Attacker impersonates attested workload and intercepts its data.
CVSS said: 9.1. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

attested-tls-poc: attestation evidence not bound to TLS, enabling relay impersonation

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

attested-tls-poc: attestation evidence not bound to TLS, enabling relay impersonation

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources