Is CVE-2026-112377 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112377?

CVE-2026-112377 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-112377

Description

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

Threat reporting mentioning CVE-2026-112377

CVE-2026-112377: TLS Relay Vulnerability DisclosedCVE-2026-112377 was published on October 19, 2026, detailing a flaw in CCC Attestation SIG's attested-tls-poc. The vulnerability allows attackers to relay valid attestation Evidenc…