{"id":"CVE-2026-56432","kind":"vulnerability","aliases":["CVE-2026-56432"],"related":[],"title":"Intel TDX MigTD signing flaw lets a hypervisor escalate privileges","description":"Unintended proxy or intermediary ('confused deputy') in the MigTD signing for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.","summary":"Intel advisory INTEL-SA-01580 (one of a batch of MigTD CVEs) covers a confused-deputy flaw in MigTD signing. A privileged system-software attacker could escalate privileges; CVSS 4.0 is 8.2. Fixed in MigTD 0.7.2.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel TDX Migration TD (MigTD) reference software","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","hypervisor","infrastructure","intel-tdx","migtd"],"not_affected_if":["managed-hosting","no-tdx-migration"],"how_to_check":"Check the MigTD build your TDX hosts/cloud provider use for live migration: any MigTD reference software version before 0.7.2 is affected. Hosts not using TD live migration do not run MigTD.","fix":"Update Intel TDX Migration TD (MigTD) reference software to version 0.7.2 or later (GitHub release v0.7.2).","status":"open","published_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:58+00:00","triaged_at":"2026-11-10T18:24:30+00:00","updated_at":"2026-11-10T18:27:00+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX MigTD signing flaw lets a hypervisor escalate privileges","impact":"high","summary":"A confused deputy flaw in the MigTD signing component of Intel TDX Migration Trust Domain lets a privileged system software attacker escalate privileges from within Ring 0. The attacker gains high integrity impact on the vulnerable system and high confidentiality and integrity impact on systems that follow it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","hypervisor","confidential-computing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Privileged local attacker escalates privileges and alters the migrated trust domain","analyst_note":"Find Intel's advisory and the affected MigTD and TDX versions and fixed firmware or module releases, since the sources give no product ranges or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tdx-migration"],"who_is_affected":"Affects hosts running Intel TDX with the MigTD Migration Trust Domain component, where a privileged local attacker in system software is the threat. The sources do not list affected versions or configurations. Teams not running Intel TDX live migration can likely skip it, but the sources do not say so.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000726,"input_tokens":4683,"output_tokens":516,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's advisory and the affected MigTD and TDX versions and fixed firmware or module releases, since the sources give no product ranges or fix.","search":"'-2026':12A,15A '-56432':13A,16A '0':93C '0.7.2':71B '01580':38B '4.0':65B '8.2':67B 'access':126C 'adversari':103C 'advisori':34B 'allow':96C 'attack':60B,113C,128C 'avail':153C,168C 'batch':42B 'combin':108C 'complex':112C 'comput':26B 'confidenti':25B,148C,163C 'confidential-comput':24B 'confus':49B,76C 'confused-deputi':48B 'could':61B 'cover':46B 'cve':11A,14A 'cves':45B 'cvss':64B 'deputi':50B,77C 'domain':89C 'enabl':115C 'escal':9A,62B,98C,116C 'fix':68B 'flaw':5A,51B 'high':151C,164C,166C 'hypervisor':8A,27B,94C 'impact':146C,170C 'infrastructur':28B 'integr':150C,165C 'intel':1A,17A,30B,33B,36B,84C 'intel-sa':35B 'intel-tdx':29B 'interact':141C 'intermediari':75C 'intern':135C 'knowledg':136C 'let':6A 'local':125C 'low':111C 'may':95C,114C,121C,145C 'migrat':87C 'migration':19A 'migtd':3A,21A,32B,44B,53B,70B,80C,90C 'none':149C,154C,169C 'occur':123C 'one':39B 'potenti':122C,143C 'present':132C 'privileg':10A,56B,63B,100C,106C,118C 'proxi':73C 'r':85C 'reference':22A 'requir':129C,138C 'result':120C,159C 'ring':92C 'sa':37B 'sign':4A,54B,81C 'softwar':59B,102C 'software':23A 'special':134C 'subsequ':161C 'system':58B,101C,158C,162C 'system-softwar':57B 'td':20A 'tdx':2A,18A,31B,86C 'trust':88C 'unintend':72C 'user':107C,140C 'via':124C 'vulner':144C,157C 'within':91C 'without':133C","nicknames":[],"mitigations":[],"who_affected":"Intel's advisory INTEL-SA-01580 lists all versions of the Intel TDX Migration Trust Domain (MigTD) reference software before 0.7.2 as affected. It matters for cloud providers and operators who run TDX hosts with TD live migration, where an attacker with privileged system software (hypervisor) access could escalate privileges. Systems that do not use MigTD or TDX live migration can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:27:00Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2495},"products":{"at":"2026-11-10T18:27:00Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2495}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["inteltdxmigrationtdmigtdreferencesoftware","tdxmigrationtdmigtdreferencesoftware"],"ptokens":["intel","migration","migtd","reference","software","td","tdx"],"labels":["confidentialcomputing","high","hypervisor","infrastructure","inteltdx","migtd"],"campaign_type":null,"search_a":"'-2026':12A,15A '-56432':13A,16A 'cve':11A,14A 'escal':9A 'flaw':5A 'hypervisor':8A 'intel':1A,17A 'let':6A 'migration':19A 'migtd':3A,21A 'privileg':10A 'reference':22A 'sign':4A 'software':23A 'td':20A 'tdx':2A,18A","search_b":"'0.7.2':71B '01580':38B '4.0':65B '8.2':67B 'advisori':34B 'attack':60B 'batch':42B 'comput':26B 'confidenti':25B 'confidential-comput':24B 'confus':49B 'confused-deputi':48B 'could':61B 'cover':46B 'cves':45B 'cvss':64B 'deputi':50B 'escal':62B 'fix':68B 'flaw':51B 'hypervisor':27B 'infrastructur':28B 'intel':30B,33B,36B 'intel-sa':35B 'intel-tdx':29B 'migtd':32B,44B,53B,70B 'one':39B 'privileg':56B,63B 'sa':37B 'sign':54B 'softwar':59B 'system':58B 'system-softwar':57B 'tdx':31B","search_c":"'0':93C 'access':126C 'adversari':103C 'allow':96C 'attack':113C,128C 'avail':153C,168C 'combin':108C 'complex':112C 'confidenti':148C,163C 'confus':76C 'deputi':77C 'domain':89C 'enabl':115C 'escal':98C,116C 'high':151C,164C,166C 'hypervisor':94C 'impact':146C,170C 'integr':150C,165C 'intel':84C 'interact':141C 'intermediari':75C 'intern':135C 'knowledg':136C 'local':125C 'low':111C 'may':95C,114C,121C,145C 'migrat':87C 'migtd':80C,90C 'none':149C,154C,169C 'occur':123C 'potenti':122C,143C 'present':132C 'privileg':100C,106C,118C 'proxi':73C 'r':85C 'requir':129C,138C 'result':120C,159C 'ring':92C 'sign':81C 'softwar':102C 'special':134C 'subsequ':161C 'system':101C,158C,162C 'tdx':86C 'trust':88C 'unintend':72C 'user':107C,140C 'via':124C 'vulner':144C,157C 'within':91C 'without':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56432","severity":null,"published_at":"2026-11-10T18:17:41+00:00","modified_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:58+00:00","fetched_at":"2026-11-10T18:22:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-56432:2495","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:27:00+00:00","modified_at":"2026-11-10T18:27:00+00:00","first_seen_at":"2026-11-10T18:27:00+00:00","fetched_at":"2026-11-10T18:27:00+00:00","note":"Read Intel INTEL-SA-01580 (released 2026-11-10): affected MigTD < 0.7.2, fix 0.7.2 per Intel and GitHub release link. Advisory is a batch of ~13 MigTD CVEs; overall rated Medium but this CVE is 8.2 High. No exploitation or PoC seen; did not search social posts. No Intel-stated workaround.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","https://github.com/intel/MigTD/releases/tag/v0.7.2"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117043,"url":"https://github.com/intel/MigTD/releases/tag/v0.7.2","title":"intel/MigTD v0.7.2","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}