PT-2026-4820 · Phala+1 · @Phala/Dcap-Qvl-Node+3
Rahul Saxena
·
Published
2026-01-26
·
Updated
2026-01-26
·
CVE-2026-22696
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
dcap-qvl versions prior to 0.3.9
Description
The dcap-qvl library contains a flaw in its quote verification logic. The library retrieves QE Identity collateral from the PCCS, but fails to verify the QE Identity signature against its certificate chain and does not enforce policy constraints on the QE Report. This allows an attacker to forge QE Identity data, potentially whitelisting a malicious or non-Intel Quoting Enclave and signing untrusted quotes that a verifier would accept as valid. This circumvents the remote attestation security model. All deployments using the dcap-qvl library for SGX or TDX quote verification are affected.
Recommendations
Upgrade to dcap-qvl version 0.3.9 to implement the missing cryptographic verification for the QE Identity signature and enforce checks for MRSIGNER, ISVPRODID, and ISVSVN against the QE Report.
Users of the
@phala/dcap-qvl-node and @phala/dcap-qvl-web packages should switch to the pure JavaScript implementation, @phala/dcap-qvl.Exploit
Fix
Improper Verification of Cryptographic Signature
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Phala/Dcap-Qvl
@Phala/Dcap-Qvl-Node
@Phala/Dcap-Qvl-Web
Dcap-Qvl