Key points
- The flaw allows relay attacks on TLS connections in confidential virtual machines.
- Privasys released fixes in versions tdx-v0.2.43 and tdx-gpu-v0.6.27.
- The National Vulnerability Database rates the issue as critical with a CVSS of 9.1.
Privasys disclosed a critical vulnerability in its Enclave OS Virtual platform that compromises the integrity of confidential container workloads. According to the National Vulnerability Database, the flaw affects versions prior to tdx-v0.2.43 and tdx-gpu-v0.6.27. The issue stems from how the system handles TLS certificate issuance within the TDX environment.
By the numbers
- 9.1: The CVSS score assigned to CVE-2026-108268 by the NVD.
- 2: The number of specific software versions that contain the security fix.
- 1: The single CVE identifier tracking this TLS relay vulnerability.
What the figures mean
The high severity score reflects the potential for remote exploitation without user interaction in certain configurations. The National Vulnerability Database classifies the weakness as CWE-346, indicating a failure to verify cryptographic signatures or bindings. This allows an attacker to manipulate the attestation process if they possess an enclave TLS private key.
The vulnerability exists because the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in the quote ReportData. However, it omitted a value bound to the active TLS session. This missing binding creates a gap that attackers can exploit to relay genuine quotes.
An attacker who obtains an enclave TLS private key can relay a genuine quote onto a different connection. This causes the relying party to accept an attacker-terminated connection as the attested enclave. Consequently, the security guarantees of the confidential virtual machine are undermined, allowing unauthorized access to workloads.
What should you do?
Managed service providers must immediately audit their Privasys Enclave OS Virtual deployments. Teams should verify the current version of their TDX and GPU components against the affected list. Upgrading to the patched versions is the only confirmed mitigation for this specific relay attack vector.
What to do and how to stay safe: Privasys
- Inventory all instances of Privasys Enclave OS Virtual to identify versions prior to tdx-v0.2.43 or tdx-gpu-v0.6.27.
- Apply the vendor-provided updates to tdx-v0.2.43 and tdx-gpu-v0.6.27 to close the TLS relay gap.
- Monitor network logs for unusual TLS connection patterns that may indicate relay attempts during the transition period.
- Review attestation logs for discrepancies between expected session bindings and actual quote data in relying parties.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Privasys Enclave OS are affected by CVE-2026-108268?
Versions prior to tdx-v0.2.43 and tdx-gpu-v0.6.27 are affected by this critical vulnerability.
What is the technical cause of this vulnerability?
The TDX/GPU RA-TLS certificate issuer omitted a value bound to the active TLS session in the quote ReportData.
Is there a fix available for this issue?
Yes, the issue is fixed in versions tdx-v0.2.43 and tdx-gpu-v0.6.27 according to the NVD record.
