CVE-2026-11836

Name of the Vulnerable Software and Affected Versions Caliptra Core ROM versions 2.0.0 through 2.0.2 Caliptra Core ROM versions 2.1.0 through 2.1.1 Caliptra Core Firmware versions 2.0.0 through 2.0.1 Caliptra Core Firmware version 2.1.0

Description Insufficient verification of data authenticity in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device. This occurs when a valid token issued for a different device sharing the same debug unlock key hash is presented to the validate debug unlock token() function. While a 384-bit challenge nonce prevents the replay of previously issued tokens, the issue results in a loss of per-device scope enforcement among devices that share the same unlock authority by design. It does not allow debug unlock on devices outside of that specific set.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.