Shut down CCC Attestation TLS PoC on open networks to block CVE-2026-112377 impersonation attacks
A critical flaw in the CCC Attestation SIG proof-of-concept allows attackers to relay valid evidence and impersonate workloads, requiring immediate isolation from untrusted networks.
Key points
- CVE-2026-112377 allows attackers to relay valid attestation evidence to impersonate workloads.
- The vulnerability exists in the attested-tls-poc project through commit 731ca82.
- Attackers need an extracted private key and the ability to forward nonces to exploit the flaw.
Attackers can impersonate legitimate workloads and intercept data by exploiting a critical flaw in the CCC Attestation SIG proof-of-concept project. This vulnerability, tracked as CVE-2026-112377, enables malicious actors to relay valid attestation evidence from genuine systems, effectively bypassing security checks designed to verify workload identity within trusted execution environments.
The flaw allows an attacker who possesses an extracted attested TLS private key to forward a relying party's nonce to a genuine attester. The attacker then replays the resulting evidence to the relying party. This process tricks the system into believing the attacker is the legitimate, attested workload, granting unauthorized access to protected data streams and services.
Technical Context
The National Vulnerability Database rates this issue as critical, assigning it a CVSS score of 9.1. The weakness is categorized under CWE-346, which relates to comparison of information using a vulnerable method. The core problem is the failure to bind early attestation evidence to the specific TLS connection, creating a gap that attackers can exploit to relay valid proofs without generating new ones.
Affected Systems
The vulnerability affects the CCC-Attestation attested-tls-poc project. Specifically, versions of the software up to and including commit 731ca82ed533fc7a1092be980887ae2e34261da2 are vulnerable. Organizations using this proof-of-concept code for testing or development in their infrastructure are at risk if the service is exposed to untrusted network traffic or external actors.
What to watch
No patch or fix has been confirmed yet for this vulnerability. Teams should monitor the CCC Attestation SIG repository for updates or patches addressing commit 731ca82. Until a fix is available, the primary mitigation is to isolate the proof-of-concept service from any untrusted networks or external traffic sources to prevent relay attacks.
What made it possible
This incident highlights the risks of decoupling cryptographic proofs from their transport context. When attestation evidence is not tightly bound to the specific session or connection, attackers can capture valid proofs and replay them in different contexts. This technique, often called relay or replay, undermines the assurance that the entity presenting the proof is the same one that generated it. Teams usually verify that binding mechanisms are in place to prevent such decoupling.
Background: Workload identity
Workload identity is a security pattern where cloud applications and services prove who they are using short-lived, automatically managed credentials. This eliminates the risk of stolen long-term secrets, ensures services only access what they need, and simplifies auditing by tying actions to specific code rather than human accounts.
Read the full guide: Workload Identity: Secure Cloud Services Without Long-Lived Keys
What to do and how to stay safe: CVE-2026-112377
- Isolate the CCC Attestation attested-tls-poc service from untrusted networks immediately to prevent external relay attempts.
- Audit your infrastructure to identify any instances of the vulnerable code through commit 731ca82.
- Monitor the vendor's repository for an official patch or updated commit that binds evidence to connections.
- Review logs for unusual attestation patterns or unexpected workload impersonation attempts during this period.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112377?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.1.
Which versions of the software are affected?
The CCC-Attestation attested-tls-poc project is affected up to and including commit 731ca82ed533fc7a1092be980887ae2e34261da2.
Is there a fix available for this vulnerability?
No fix has been confirmed yet; users should isolate the service and wait for an update from the vendor.
