Privasys rustls Quote Relay Flaw Bypasses Attestation; Update to v0.8.1 Fixes RA-TLS Binding

Privasys rustls, a specialized fork of the rustls TLS library, contains a critical vulnerability identified as CVE-2026-108266. The flaw allows attackers to relay genuine attestation quotes to different connections, effectively bypassing security checks designed to verify enclave identity in remote attestation protocols.

According to the National Vulnerability Database, the issue carries a CVSS score of 9.1, rated as critical. The vulnerability stems from how the library constructs RA-TLS challenge certificates. In versions prior to privasys-v0.8.1, the quote ReportData was bound to the certificate public key and the client nonce but failed to bind to the active TLS session.

Technical Background

The Privasys rustls fork adds RA-TLS challenge and channel-binding support to the standard rustls library. This functionality is essential for secure communication with trusted execution environments. The security model relies on binding the attestation quote tightly to the specific cryptographic session to prevent reuse or manipulation of the attestation data.

When the binding to the active TLS session is missing, an attacker who obtains an enclave TLS private key can exploit the gap. They can take a genuine quote from one connection and relay it onto another connection. This causes the relying party to accept the attacker-terminated connection as the legitimate, attested enclave.

Affected Software

The vulnerability affects all versions of Privasys rustls prior to privasys-v0.8.1. Organizations using this specific fork for secure enclave communications are directly at risk if they have not updated their libraries. The CVE record explicitly lists the affected range as Privasys rustls < privasys-v0.8.1.

The weakness is classified under CWE-346, which relates to origin validation errors. Because the library is a maintained fork, users relying on its specific attestation features must ensure they are running the patched release. Older installations remain vulnerable to the quote relay mechanism described in the advisory.

Our take on the response

Privasys addressed the issue in release privasys-v0.8.1. The update fixes the binding logic to ensure that the quote ReportData is correctly tied to the active TLS session. This prevents the relay of quotes across different connections.

Users of Privasys rustls should verify their current library version immediately. If the version is older than 0.8.1, the attestation process cannot be trusted to prevent impersonation attacks. Updating to the fixed version restores the intended security guarantees of the RA-TLS protocol implementation.

Background: CVSS score

The Common Vulnerability Scoring System (CVSS) assigns a numerical score from 0.0 to 10.0 to software vulnerabilities. It calculates this number by weighing factors like attack complexity, required privileges, and impact on confidentiality, integrity, and availability. You use the score to compare the severity of different flaws, but you must adjust for your own context to prioritize fixes correctly.

Read the full guide: How CVSS Scores Work: The Math Behind Vulnerability Ratings

What to do and how to stay safe: Privasys

• Check your dependency management system to identify if Privasys rustls is included in your build artifacts.
• Verify the specific version number of the library to ensure it is privasys-v0.8.1 or newer.
• Review your remote attestation logs for any anomalies that might indicate quote relay attempts if you cannot update immediately.
• Monitor vendor communications for further patches if you rely on custom builds of the rustls fork.

Step-by-step guide: Vulnerability Prioritization for Small Businesses

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108266?

CVE-2026-108266 is a critical vulnerability in Privasys rustls that allows quote relay attacks by failing to bind attestation data to the TLS session.

Which versions are affected?

All versions of Privasys rustls prior to privasys-v0.8.1 are affected by this vulnerability.

Is there a fix available?

Yes, Privasys released version 0.8.1 which fixes the missing TLS session binding in the RA-TLS challenge certificates.