Privasys Go Flaw Lets Attackers Relay Attestation Certificates

Organizations relying on Privasys Go for secure enclave communications face a critical remote attestation bypass. The National Vulnerability Database assigned CVE-2026-108267 a CVSS score of 9.1, classifying it as Critical. This flaw allows attackers to manipulate the trust chain between enclaves and relying parties.

The risk

The vulnerability stems from how challenge-mode RA-TLS certificates handle data binding. According to the NVD record, earlier versions of Privasys Go bound the ReportData quote to the certificate public key and client nonce. However, these certificates did not bind the quote to the active TLS session. This missing binding creates a relay window.

An attacker who obtains an enclave TLS private key can exploit this gap. They can take a genuine quote from one connection and relay it onto another. The relying party accepts the handshake as if it were terminated by an attested enclave. The attacker effectively masquerades as a trusted entity without possessing the original enclave’s active session state.

Who is exposed

The issue affects Privasys Go, which is a maintained fork of the Go programming language. This fork adds RA-TLS support to the standard crypto/tls package. Any application using Privasys Go versions prior to privasys-v0.5.1-go1.26.5 is exposed. The flaw exists in the certificate validation logic within these older builds.

Cost and compliance

The NVD record does not specify financial damages or regulatory penalties associated with this vulnerability. The source material focuses solely on the technical mechanics of the relay attack. There is no mention of confirmed breaches or specific industries targeted by attackers exploiting CVE-2026-108267.

What happens next

Privasys has released a fix in version privasys-v0.5.1-go1.26.5. This update corrects the binding logic to include the active TLS session. Managers should verify their current Privasys Go version immediately. Upgrading to the patched version eliminates the relay vector described in the advisory.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: Privasys Go

• Audit your dependency tree to identify any use of Privasys Go versions older than v0.5.1-go1.26.5.
• Monitor TLS handshake logs for anomalies that might indicate quote relay attempts.
• Plan an upgrade path to the patched version once the vendor provides an update.
• Review your remote attestation policies to ensure session binding is enforced.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108267?

It is a critical vulnerability in Privasys Go that allows attackers to relay enclave quotes to bypass attestation checks.

Which versions are affected?

All Privasys Go versions prior to privasys-v0.5.1-go1.26.5 are affected by this certificate relay flaw.

Is there a fix available?

Yes, the issue is fixed in Privasys Go version privasys-v0.5.1-go1.26.5.