What’s Vulnerable › Vulnerabilities
CVE-2026-11836: Production Debug-Unlock Token Verification Missing Device Binding
- Severity: low (CVSS 1.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-04 · updated 2026-09-03
- Weakness: CWE-345
Description
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Affected products
- Caliptra Core Firmware: from 2.0.0 through 2.0.1; 2.1.0
- Caliptra Core ROM: from 2.0.0 through 2.0.2; from 2.1.0 through 2.1.1
References
Get alerted when CVE-2026-11836 or the next vulnerability affects your stack