high · CVSS v3 7.5 · CVSS v4 8.7
CVE-2026-92792
OpenNHP versions up to 1.0.2 allow an attacker to bypass trusted‑execution attestation by supplying evidence with a test_purpose key. This c
Overview
OpenNHP versions up to 1.0.2 allow an attacker to bypass trusted‑execution attestation by supplying evidence with a test_purpose key. This causes the fallback verifier to run unconditionally, letting attackers use allowlisted measure/serial number pairs to gain unauthorized access.
Description
OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.
Impact
Confidentiality: attackers can read protected data or gain privileged access. Integrity: attackers can modify or inject data. Availability: not directly affected.
Remediation
['Apply the official patch that updates OpenNHP to version 1.0.3 or later.', 'If a patch is unavailable, disable or remove the test_purpose key handling in the attestation verifier and enforce strict verification of evidence.', 'Implement network segmentation and least‑privilege controls to limit the blast radius of any unauthorized access.', 'Monitor authentication logs for anomalous evidence submissions and enforce multi‑factor authentication for privileged operations.']
Risk context
High severity (CVSS v3 7.5, v4 8.7). The vulnerability enables direct bypass of attestation, posing a significant confidentiality and integrity risk. Prompt patching or mitigation is recommended.
Affected products
- OpenNHP
- OpenNHP 1.0.2
Scores
- Severity
- high
- CVSS v2
- 7.8
- CVSS v3
- 7.5
- CVSS v4
- 8.7
- EPSS
- —