{"id":"CVE-2026-42067","kind":"vulnerability","aliases":["CVE-2026-42067"],"related":[],"title":"Intel TDX Workload Attestation: improper certificate validation lets local apps tamper data","description":"Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Some Intel TDX Workload Attestation software running in user space does not validate certificates properly. A local, unprivileged attacker can manipulate data and may escalate privileges on the vulnerable system.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["confidential-computing","infrastructure","intel-tdx","linux"],"not_affected_if":["attestation-not-installed","no-tdx-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T17:17:43+00:00","first_seen_at":"2026-11-10T17:22:43+00:00","triaged_at":"2026-11-10T17:24:15+00:00","updated_at":"2026-11-10T17:24:15+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T17:24:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX Workload Attestation: improper certificate validation lets local apps tamper data","impact":"medium","summary":"Some Intel TDX Workload Attestation software running in user space does not validate certificates properly. A local, unprivileged attacker can manipulate data and may escalate privileges on the vulnerable system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","confidential-computing","linux"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local attacker manipulates attestation data and escalates privileges","analyst_note":"Find the Intel security advisory for CVE-2026-42067 to get affected product versions and fixed releases; NVD text alone does not state them.","how_to_check":"unknown","plain_action":"","product_name":"Intel TDX Workload Attestation software","needs_analyst":true,"not_affected_if":["no-tdx-hardware","attestation-not-installed"],"who_is_affected":"Systems that run Intel TDX confidential computing with the Workload Attestation software installed are the ones to look at. The sources do not name the affected package versions. Teams not using Intel TDX attestation can likely skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4653,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-42067':15A,18A '3':70C 'access':103C 'adversari':81C 'allow':74C 'app':10A 'applic':72C 'attack':45B,91C,105C 'attest':4A,31B,66C 'avail':129C,144C 'certif':6A,40B,58C 'combin':86C 'complex':90C 'comput':21B 'confidenti':20B,124C,139C 'confidential-comput':19B 'cve':13A,16A 'data':12A,48B,94C 'enabl':93C 'escal':51B,76C 'high':127C 'impact':122C,146C 'improp':5A,57C 'infrastructur':22B 'integr':126C,141C 'intel':1A,24B,28B,62C 'intel-tdx':23B 'interact':117C 'intern':111C 'knowledg':112C 'let':8A 'linux':26B 'local':9A,43B,102C 'low':89C 'manipul':47B,95C 'may':50B,73C,92C,98C,121C 'none':125C,130C,140C,142C,145C 'occur':100C 'potenti':99C,119C 'present':108C 'privileg':52B,78C 'proper':41B 'r':63C 'requir':106C,114C 'result':97C,135C 'ring':69C 'run':33B 'softwar':32B,67C,80C 'space':36B 'special':110C 'subsequ':137C 'system':56B,134C,138C 'tamper':11A 'tdx':2A,25B,29B,64C 'unauthent':84C 'unprivileg':44B,79C 'user':35B,71C,85C,116C 'valid':7A,39B,59C 'via':101C 'vulner':55B,120C,133C 'within':68C 'without':109C 'workload':3A,30B,65C","nicknames":[],"mitigations":[],"who_affected":"Systems that run Intel TDX confidential computing with the Workload Attestation software installed are the ones to look at. The sources do not name the affected package versions. Teams not using Intel TDX attestation can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["confidentialcomputing","infrastructure","inteltdx","linux","medium"],"campaign_type":null,"search_a":"'-2026':14A,17A '-42067':15A,18A 'app':10A 'attest':4A 'certif':6A 'cve':13A,16A 'data':12A 'improp':5A 'intel':1A 'let':8A 'local':9A 'tamper':11A 'tdx':2A 'valid':7A 'workload':3A","search_b":"'attack':45B 'attest':31B 'certif':40B 'comput':21B 'confidenti':20B 'confidential-comput':19B 'data':48B 'escal':51B 'infrastructur':22B 'intel':24B,28B 'intel-tdx':23B 'linux':26B 'local':43B 'manipul':47B 'may':50B 'privileg':52B 'proper':41B 'run':33B 'softwar':32B 'space':36B 'system':56B 'tdx':25B,29B 'unprivileg':44B 'user':35B 'valid':39B 'vulner':55B 'workload':30B","search_c":"'3':70C 'access':103C 'adversari':81C 'allow':74C 'applic':72C 'attack':91C,105C 'attest':66C 'avail':129C,144C 'certif':58C 'combin':86C 'complex':90C 'confidenti':124C,139C 'data':94C 'enabl':93C 'escal':76C 'high':127C 'impact':122C,146C 'improp':57C 'integr':126C,141C 'intel':62C 'interact':117C 'intern':111C 'knowledg':112C 'local':102C 'low':89C 'manipul':95C 'may':73C,92C,98C,121C 'none':125C,130C,140C,142C,145C 'occur':100C 'potenti':99C,119C 'present':108C 'privileg':78C 'r':63C 'requir':106C,114C 'result':97C,135C 'ring':69C 'softwar':67C,80C 'special':110C 'subsequ':137C 'system':134C,138C 'tdx':64C 'unauthent':84C 'unprivileg':79C 'user':71C,85C,116C 'valid':59C 'via':101C 'vulner':120C,133C 'within':68C 'without':109C 'workload':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42067","severity":null,"published_at":"2026-11-10T17:17:43+00:00","modified_at":"2026-11-10T17:17:43+00:00","first_seen_at":"2026-11-10T17:22:43+00:00","fetched_at":"2026-11-10T17:22:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}