Read the docs
TI-2026-10214 Aliases CVE-2026-11836

Production Debug-Unlock Token Verification Missing Device Binding

Priority LOW 9CWE-345Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0011 1st percentileScored 2026-11-07
Fix Fixed Core ROM (Caliptra): 2.0.3, 2.1.2Core Firmware (Caliptra): 2.0.2, 2.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CaliptraCore ROM2.0.0 – 2.0.2; 2.1.0 – 2.1.12.0.3, 2.1.2Patch availableCNA
CaliptraCore Firmware2.0.0 – 2.0.1; 2.1.02.0.2, 2.1.1Patch availableCNA
  • Core ROM VendorCaliptra Affected 2.0.0 – 2.0.2; 2.1.0 – 2.1.1 Fixed in 2.0.3, 2.1.2 Patch available CNA
  • Core Firmware VendorCaliptra Affected 2.0.0 – 2.0.1; 2.1.0 Fixed in 2.0.2, 2.1.1 Patch available CNA

Remediation

  • Fix · CNA Core ROM (Caliptra) Fixed in 2.0.3, 2.1.2
  • Fix · CNA Core Firmware (Caliptra) Fixed in 2.0.2, 2.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11836

References

Other 1

  • TI-2026-05099 MCU Firmware Update Authentication Bypass on Caliptra Core CVSS 4.0HIGH 7.2
  • TI-2026-06435 Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service CVSS 4.0MEDIUM 6.8
  • TI-2026-10213 Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU) CVSS 4.0MEDIUM 5.6
  • TI-2026-05666 AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences