CVE-2026-108361 Privasys CVE debrief

Who should care

Defenders and administrators of TLS endpoint configurations using Privasys ra-tls-clients should assess exposure and prioritize verification and upgrades. This includes reviewing and updating incident response plans, verifying attestation and verification processes, and assessing exposure in TLS endpoint configurations. Operators, platform administrators, and security teams should review the vulnerability and take necessary actions to prevent TOCTOU

Why it matters

CVE-2026-108361 is a high-severity vulnerability in Privasys ra-tls-clients that allows for TOCTOU attacks, impacting defenders and administrators of TLS endpoint configurations.

• Verify attestation and verification processes to prevent TOCTOU attacks
• Upgrade to version 0.9.1 or later to fix the vulnerability
• Assess exposure in TLS endpoint configurations
• Review and update incident response plans

Technical summary

Privasys ra-tls-clients before version 0.9.1 is vulnerable to TOCTOU attacks due to performing attestation only once in the lifetime of the connection. This allows an attacker with local access to modify workload code, data, and configuration at any time after successful connection establishment. The vulnerability is fixed in version 0.9.1. Defenders should prioritize verifying and upgrading to version 0.9.1 or later of Privasys ra-tls-clients, and assess exposure in TLS endpoint configurations. The vulnerability has a high severity with a CVSS score of 7.2.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.9.1 or later of Privasys ra-tls-clients, and assess exposure in TLS endpoint configurations.

Recommended defensive actions

• Verify and upgrade to version 0.9.1 or later of Privasys ra-tls-clients
• Assess exposure in TLS endpoint configurations
• Review and update attestation and verification processes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence throughout, whereas it could be stale at some point in time. Evidence was successfully appraised and the connection was established, there was

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.