CVE-2026-11836

Production Debug-Unlock Token Verification Missing Device Binding

Published Aug 4, 2026 CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Description

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set.

This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.

Analysis

Technical impact

Insufficient verification in Caliptra Core ROM and Core Firmware's validate_debug_unlock_token() allows a token issued for one device to unlock production debug on another device that shares the same unlock authority key hash. The 384‑bit challenge nonce still blocks replay attacks, but the vulnerability removes the per-device binding that should restrict debug unlock to the intended device.

Affected Systems

Affected vendor Caliptra includes the Core ROM and Core Firmware products. Core ROM versions 2.0.0 through 2.0.2 and 2.1.0 through 2.1.1 are impacted, as are Core Firmware versions 2.0.0 through 2.0.1 and 2.1.0.

Risk and Exploitability

The CVSS score of 1.8 indicates a low severity vulnerability, and the EPSS score is not available while it is not in the CISA KEV catalog. The likely attack vector requires an attacker to have access to the integrator's debug unlock signing service, enabling the issuance of a valid token for a target device. This bypass only affects devices that share the same unlock authority key and does not extend to devices outside that set, so the overall risk to broader systems remains limited.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Caliptra

Core ROM

unaffected

Version	Status	Constraints
`2.0.0`	affected	≤ 2.0.2
`2.0.3`	unaffected	—
`2.1.0`	affected	≤ 2.1.1
`2.1.2`	unaffected	—

Caliptra

Core Firmware

unaffected

Version	Status	Constraints
`2.0.0`	affected	≤ 2.0.1
`2.0.2`	unaffected	—
`2.1.0`	affected	—
`2.1.1`	unaffected	—

No data.

Vendor Product Versions

Caliptra

Core Firmware

Version	Status	Scheme	Platform
`[2.0.0,2.0.1]`	affected	semver	—
`2.0.2`	unaffected	semver	—
`2.1.0`	affected	semver	—
`2.1.1`	unaffected	semver	—

Caliptra

Core Rom

Version	Status	Scheme	Platform
`[2.0.0,2.0.2]`	affected	semver	—
`2.0.3`	unaffected	semver	—
`[2.1.0,2.1.1]`	affected	semver	—
`2.1.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Caliptra Core ROM and Core Firmware to a non‑affected version (e.g., a release newer than 2.1.1 for ROM and 2.1.0 for Firmware if available).
Restrict and monitor access to the integrator's debug unlock signing service, ensuring only authorized personnel can issue tokens.
Verify that debug unlock tokens are bound to an explicit device identifier; if the current implementation lacks this check, implement an additional validation step that rejects tokens not matching the target device.
As a temporary measure, disable production debug unlock functionality on devices that are not actively being debugged until the patch can be applied.

Generated by OpenCVE AI on August 4, 2026 at 09:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.110% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-hw68-jjx4-m376

History

Aug 7, 2026 11:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Caliptra Caliptra core Firmware Caliptra core Rom
Vendors & Products		Caliptra Caliptra core Firmware Caliptra core Rom

Aug 4, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 4, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Title		Production Debug-Unlock Token Verification Missing Device Binding
Weaknesses		CWE-345
References		https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-hw68-jjx4-m376
Metrics		cvssV4_0 `{'score': 1.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`