---
id: CVE-2026-108361
title: >-
  Privasys Remote Attestation TLS Clients provides multi-language utilities for
  verifying attested TLS connections
summary: >-
  Privasys Remote Attestation TLS Clients provides multi-language utilities for
  verifying attested TLS connections. Before 0.9.1, an attacker with local
  access could modify workload code, data, and configuration at any time after
  successfu…
severity: none
cwe:
  - CWE-367
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T20:17:07.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108361'
references:
  - url: >-
      https://github.com/Privasys/ra-tls-clients/commit/076074873117ee5ff35a7c39e02952c28de3df0c
    label: security-advisories@github.com
  - url: >-
      https://github.com/Privasys/ra-tls-clients/commit/5ccfd778132e17cb54bb1a9c7b89d57fcfea59ec
    label: security-advisories@github.com
  - url: >-
      https://github.com/Privasys/ra-tls-clients/commit/b9114d772a636ad3307957dde4bb8afe70c9b40d
    label: security-advisories@github.com
  - url: >-
      https://github.com/Privasys/ra-tls-clients/security/advisories/GHSA-gg8q-mfhh-wrrc
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-12T21:04:28.916Z'
---

## Overview

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. This vulnerability is fixed in 0.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.