NVD Rates CCC Attestation TLS PoC Relay Flaw Critical CVE-2026-112377

An attacker who extracts an attested TLS private key can use a critical flaw in the CCC Attestation TLS proof-of-concept to impersonate legitimate workloads. By relaying valid attestation evidence from a genuine source, the adversary can bypass security checks and intercept data intended for the verified workload. This capability allows the attacker to act as a trusted entity within the system without possessing the original credentials directly.

In plain English

The vulnerability exists because the software fails to bind early attestation evidence to the specific TLS connection. This gap allows an attacker to take a valid response from a real attester and forward it to a relying party. The relying party accepts the replayed evidence as if it came from the expected source, enabling the attacker to masquerade as the attested workload and capture sensitive information during the session.

The background

The issue affects the CCC Attestation SIG attested-tls-poc project through commit 731ca82ed533fc7a1092be980887ae2e34261da2. According to the National Vulnerability Database, the flaw is classified under CWE-346, which relates to origin validation errors. The NVD assigned the vulnerability a CVSS score of 9.1, rating it as Critical. This high severity reflects the potential for complete impersonation and data interception when the flaw is exploited by an attacker with access to the private key.

What changes now

Security teams using this proof-of-concept implementation must treat the software as vulnerable to relay attacks. The ability to forward nonces and replay evidence means that standard attestation checks are insufficient for securing connections. Organizations relying on this specific version of the CCC Attestation TLS PoC should assess their exposure to untrusted traffic. No patch has been confirmed yet for this specific commit range, so operational changes may be necessary to mitigate the risk of workload impersonation.

What made it possible

This incident illustrates the risk of decoupling cryptographic proof from the transport layer. When attestation evidence is not cryptographically bound to the specific session or connection, it becomes portable. Attackers can extract valid proofs from legitimate sources and replay them in different contexts. This weakness typically serves the initial access or lateral movement phase of an intrusion, allowing adversaries to assume trusted identities. Teams usually encounter this when protocols fail to enforce strict context validation for security tokens.

What to do and how to stay safe: CCC Attestation

• Isolate the CCC Attestation TLS proof-of-concept from untrusted networks to prevent external actors from interacting with the service.
• Monitor for anomalous attestation requests that do not correlate with expected workload behavior or connection patterns.
• Review access controls to ensure that extracted private keys cannot be used to initiate relay attacks against relying parties.
• Wait for the vendor to provide an update that binds attestation evidence directly to the TLS connection before exposing the service to broad traffic.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The CVE ID is CVE-2026-112377.

How severe is this flaw according to the NVD?

The NVD rates it as Critical with a CVSS score of 9.1.

Which software versions are affected?

The CCC Attestation SIG attested-tls-poc through commit 731ca82 is affected.