rootpwn

high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-92792

OpenNHP versions up to 1.0.2 allow an attacker to bypass trusted‑execution attestation by supplying evidence with a test_purpose key. This c

Overview

OpenNHP versions up to 1.0.2 allow an attacker to bypass trusted‑execution attestation by supplying evidence with a test_purpose key. This causes the fallback verifier to run unconditionally, letting attackers use allowlisted measure/serial number pairs to gain unauthorized access.

Description

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.

Impact

Confidentiality: attackers can read protected data or gain privileged access. Integrity: attackers can modify or inject data. Availability: not directly affected.

Remediation

['Apply the official patch that updates OpenNHP to version 1.0.3 or later.', 'If a patch is unavailable, disable or remove the test_purpose key handling in the attestation verifier and enforce strict verification of evidence.', 'Implement network segmentation and least‑privilege controls to limit the blast radius of any unauthorized access.', 'Monitor authentication logs for anomalous evidence submissions and enforce multi‑factor authentication for privileged operations.']

Risk context

High severity (CVSS v3 7.5, v4 8.7). The vulnerability enables direct bypass of attestation, posing a significant confidentiality and integrity risk. Prompt patching or mitigation is recommended.

Affected products

  • OpenNHP
  • OpenNHP 1.0.2

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS

attestation-bypass fallback-verifier OpenNHP authentication-bypass confidentiality-impact high-severity

← All CVEs