{"id":"CVE-2026-57890","kind":"vulnerability","aliases":["CVE-2026-57890"],"related":[],"title":"Intel TDX MigTD: improper cleanup after exception can leak data over network","description":"Improper cleanup on thrown exception in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Intel's MigTD component, which handles migration of confidential VMs under TDX, does not clean up properly when an exception is thrown in its SPDM responder. A network attacker without credentials can read data exposed by this, with confidentiality impact only.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MigTD","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","hypervisor","infrastructure","intel-tdx","migtd"],"not_affected_if":["no-tdx-migration"],"how_to_check":"Check the version of the MigTD binary/build you deploy for TDX live migration (built from github.com/intel/MigTD, or supplied by your platform/cloud vendor): any version before 0.7.2 is affected. If you do not use TDX live migration (no MigTD), you can skip this.","fix":"Update Intel TDX Migration Trust Domain (MigTD) reference software to version 0.7.2 or later (https://github.com/intel/MigTD/releases/tag/v0.7.2). Intel lists no workarounds.","status":"open","published_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","triaged_at":"2026-11-10T18:24:18+00:00","updated_at":"2026-11-10T18:26:58+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Intel TDX MigTD: improper cleanup after exception can leak data over network","impact":"high","summary":"Intel's MigTD component, which handles migration of confidential VMs under TDX, does not clean up properly when an exception is thrown in its SPDM responder. A network attacker without credentials can read data exposed by this, with confidentiality impact only.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","confidential-computing","hypervisor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"network attacker reads confidential data from migration trust domain","analyst_note":"Find Intel's security advisory and the affected MigTD/TDX module versions and fixes; the NVD entry gives no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"Intel TDX MigTD","needs_analyst":true,"not_affected_if":["no-tdx-migration"],"who_is_affected":"Affects hosts running Intel TDX confidential VMs that use the MigTD migration trust domain, where the SPDM responder is reachable over the network. Sources do not list affected versions or describe the configuration needed to be exposed, so teams should confirm whether they use TDX live migration before assuming exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4680,"output_tokens":513,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory and the affected MigTD/TDX module versions and fixes; the NVD entry gives no product ranges.","search":"'-2026':14A,17A '-57890':15A,18A '0':91C 'access':121C 'adversari':99C 'allow':94C 'attack':57B,109C,123C 'avail':148C,163C 'clean':43B 'cleanup':5A,70C 'combin':104C 'complex':108C 'compon':32B 'comput':22B 'confidenti':21B,37B,67B,143C,158C 'confidential-comput':20B 'credenti':59B 'cve':13A,16A 'data':10A,62B,112C 'disclosur':97C 'domain':87C 'enabl':111C 'except':7A,48B,73C 'expos':63B 'exposur':113C 'handl':34B 'high':144C 'hypervisor':23B,92C 'impact':68B,141C,165C 'improp':4A,69C 'inform':96C 'infrastructur':24B 'integr':145C,160C 'intel':1A,26B,29B,82C 'intel-tdx':25B 'interact':136C 'intern':130C 'knowledg':131C 'leak':9A 'low':107C 'may':93C,110C,116C,140C 'migrat':35B,85C 'migtd':3A,19A,28B,31B,76C,88C 'network':12A,56B,98C,120C 'none':146C,149C,159C,161C,164C 'occur':118C 'potenti':117C,138C 'present':127C 'proper':45B 'r':83C 'read':61B 'requir':124C,133C 'respond':54B,79C 'result':115C,154C 'ring':90C 'spdm':53B,78C 'special':129C 'subsequ':156C 'system':153C,157C 'tdx':2A,27B,40B,84C 'thrown':50B,72C 'trust':86C 'unauthent':102C 'user':103C,135C 'via':119C 'vms':38B 'vulner':139C,152C 'within':89C 'without':58B,128C","nicknames":[],"mitigations":[],"who_affected":"Affects deployments of Intel TDX live migration that run the MigTD (Migration Trust Domain) reference software before version 0.7.2. Intel describes the flaw as an unauthenticated network attacker reaching the MigTD's SPDM responder, which fails to clean up after an exception and can expose data (confidentiality only). Hosts and cloud providers running TDX confidential VMs with migration enabled should check; anyone not using TDX migration can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:26:58Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2492},"products":{"at":"2026-11-10T18:26:58Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2492}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["migtd"],"ptokens":["migtd"],"labels":["confidentialcomputing","high","hypervisor","infrastructure","inteltdx","migtd"],"campaign_type":null,"search_a":"'-2026':14A,17A '-57890':15A,18A 'cleanup':5A 'cve':13A,16A 'data':10A 'except':7A 'improp':4A 'intel':1A 'leak':9A 'migtd':3A,19A 'network':12A 'tdx':2A","search_b":"'attack':57B 'clean':43B 'compon':32B 'comput':22B 'confidenti':21B,37B,67B 'confidential-comput':20B 'credenti':59B 'data':62B 'except':48B 'expos':63B 'handl':34B 'hypervisor':23B 'impact':68B 'infrastructur':24B 'intel':26B,29B 'intel-tdx':25B 'migrat':35B 'migtd':28B,31B 'network':56B 'proper':45B 'read':61B 'respond':54B 'spdm':53B 'tdx':27B,40B 'thrown':50B 'vms':38B 'without':58B","search_c":"'0':91C 'access':121C 'adversari':99C 'allow':94C 'attack':109C,123C 'avail':148C,163C 'cleanup':70C 'combin':104C 'complex':108C 'confidenti':143C,158C 'data':112C 'disclosur':97C 'domain':87C 'enabl':111C 'except':73C 'exposur':113C 'high':144C 'hypervisor':92C 'impact':141C,165C 'improp':69C 'inform':96C 'integr':145C,160C 'intel':82C 'interact':136C 'intern':130C 'knowledg':131C 'low':107C 'may':93C,110C,116C,140C 'migrat':85C 'migtd':76C,88C 'network':98C,120C 'none':146C,149C,159C,161C,164C 'occur':118C 'potenti':117C,138C 'present':127C 'r':83C 'requir':124C,133C 'respond':79C 'result':115C,154C 'ring':90C 'spdm':78C 'special':129C 'subsequ':156C 'system':153C,157C 'tdx':84C 'thrown':72C 'trust':86C 'unauthent':102C 'user':103C,135C 'via':119C 'vulner':139C,152C 'within':89C 'without':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57890","severity":null,"published_at":"2026-11-10T18:17:41+00:00","modified_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","fetched_at":"2026-11-10T18:22:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-57890:2492","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:26:58+00:00","modified_at":"2026-11-10T18:26:58+00:00","first_seen_at":"2026-11-10T18:26:58+00:00","fetched_at":"2026-11-10T18:26:58+00:00","note":"Intel INTEL-SA-01580 (11/10/2026, covers many MigTD CVEs): all MigTD reference software before 0.7.2 affected, fixed in 0.7.2 (GitHub release). No workarounds, no exploitation statement. Intel scores this CVE CVSS 4.0 8.7 (AV:N, PR:N, VC:H); advisory overall rating Medium. Release page not read, fix taken from advisory text.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","https://github.com/intel/MigTD/releases/tag/v0.7.2"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117043,"url":"https://github.com/intel/MigTD/releases/tag/v0.7.2","title":"intel/MigTD v0.7.2","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}