CVE-2026-42067

Name of the Vulnerable Software and Affected Versions Intel(R) TDX Workload Attestation versions prior to 0.2.0

Description Improper certificate validation in the tdx workload attestation::verification::x509::verify x509 cert() function allows for an escalation of privilege. The function verifies the certificate signature and checks if the issuer cert issued the cert, but fails to validate the certificate's validity period. Consequently, expired or not-yet-valid certificates are accepted. When the host-verification feature is used, this leads to improper validation. Additionally, with the host-gcp-tdx feature, the GCP launch endorsement signing certificate is validated against the GCE confidential-computing TCB root certificate without checking the validity period. A local unprivileged adversary could exploit this to enable data manipulation.

Recommendations Update to version 0.2.0.