Critical TLS Flaw in Privasys rustls Allows Quote Relay Attacks

A critical vulnerability in the Privasys rustls library allows attackers to bypass enclave attestation checks by relaying valid quotes to unauthorized connections. The flaw, identified as CVE-2026-108266, affects versions of the library prior to privasys-v0.8.1 and has been assigned a CVSS score of 9.1, indicating a critical severity level according to the National Vulnerability Database.

The vulnerability exists within the Remote Attestation (RA)-TLS implementation of the Privasys rustls fork, which is a maintained branch of the standard rustls TLS library. The fork adds specific support for RA-TLS challenges and channel binding. In affected versions, the library emits RA-TLS challenge certificates where the quote ReportData is bound to the certificate public key and the client nonce. However, the ReportData is not bound to the active TLS session. This lack of session binding creates a window for relay attacks.

Context and Background

The technical nature of this flaw allows an attacker who has obtained an enclave TLS private key to exploit the missing session binding. By capturing a genuine quote from a legitimate connection, an attacker can relay that quote onto a different connection. Because the quote is not cryptographically tied to the specific session in which it was generated, a relying party may accept the attacker-terminated connection as if it were the attested enclave. This effectively breaks the trust model of remote attestation, as the relying party cannot distinguish between the genuine enclave and the attacker’s relayed connection.

Privasys rustls is designed to provide TLS functionality with enhanced security features for enclave environments. The addition of RA-TLS challenge and channel-binding support is intended to strengthen the verification process for remote enclaves. However, the incomplete implementation of these bindings in versions prior to 0.8.1 undermines these security goals. The issue is classified under CWE-346, which relates to insufficient verification of data authenticity.

Who Is Affected

Any system or application using the Privasys rustls library in versions earlier than privasys-v0.8.1 is vulnerable to this attack. This includes software that relies on the library for TLS connections involving remote attestation of enclaves. Organizations that have implemented enclave-based security solutions using this specific library fork need to verify their current version. If the version is below 0.8.1, the attestation process cannot be trusted to prevent relay attacks by actors with access to enclave TLS private keys.

The fix for this issue is included in version privasys-v0.8.1 of the Privasys rustls library. Users of affected versions should upgrade to this release or later to ensure that the quote ReportData is properly bound to the active TLS session, thereby preventing the relay of genuine quotes to unauthorized connections.

What should you do?

Security teams should immediately audit their software dependencies to identify any use of the Privasys rustls library. If the library is present, check the version number against the affected range. Systems running versions prior to privasys-v0.8.1 are at risk and should be updated to the patched version as soon as possible. Until an update can be applied, monitor network traffic for anomalies that might indicate relay attempts, such as unusual connection patterns or repeated attestation challenges.