CVE Alert: CVE-2026-112377 – CCC-Attestation – attested-tls

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party’s nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

**Risk verdict:** High-impact but conditional risk; urgency cannot be confirmed because KEV, SSVC, EPSS and PoC status were not provided.

**Why this matters:** A successful relay could undermine workload identity checks, letting an attacker impersonate a trusted service and expose or alter sensitive traffic. The attack is most credible where an attacker has obtained an attested TLS private key and can reach a genuine attester.

**Most likely attack path:** The path is network-based, requires high effort and a specific prerequisite, but needs neither prior privileges nor user interaction. The unchanged scope suggests impact is concentrated within the vulnerable trust boundary; broader lateral movement would depend on what the impersonated workload can access.

**Who is most exposed:** Prioritise teams using remote-attestation-based TLS in prototypes, test environments or bespoke service-to-service deployments. Confirm whether this proof-of-concept code, or code derived from it, is present in production.

Alert on attestation evidence reused across distinct TLS sessions or relying parties.

Correlate nonce requests and evidence responses across endpoints for unexpected relaying.

Review TLS and attestation logs for identity claims inconsistent with the connecting workload.

Hunt for unexpected use of attested private keys and access by the impersonated identity.

Mitigation and prioritisation

Establish KEV, SSVC, EPSS and PoC status; obtain these before setting final urgency.

Upgrade or apply the maintainer’s handshake-binding fix; verify the resulting evidence is bound to its TLS session.

Until fixed, restrict access to attestation services and protect keys against extraction.

Test the change in a representative environment; monitor attestation failures during rollout.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.