{"id":"CVE-2026-11836","summary":"Production Debug-Unlock Token Verification Missing Device Binding","details":"Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set.\n\nThis issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.","aliases":["GHSA-hw68-jjx4-m376"],"modified":"2026-08-07T11:48:51.670417002Z","published":"2026-08-04T00:02:34.093Z","database_specific":{"cna_assigner":"Caliptra","cwe_ids":["CWE-345"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11836.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11836.json"},{"type":"ADVISORY","url":"https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-hw68-jjx4-m376"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11836"},{"type":"PACKAGE","url":"https://github.com/chipsalliance/caliptra-sw"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/chipsalliance/caliptra-sw","events":[{"introduced":"62c8009df12bb5e6d63479e82b8335aaa8ba84c6"},{"fixed":"473ae25561881ab9eca8b84e0ea14e43d18e1993"},{"fixed":"3824083e4632ecbdff50aa2e723e89fa42d9dcf6"},{"introduced":"a72a76f234d9f7069ddd1e8b8ebef30a9c3fa326"},{"fixed":"510a23adbc911e8e72708799daba964ec045ef25"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"},{"fixed":"2.0.1"},{"introduced":"2.1.0"},{"fixed":"2.1.1"}],"source":"DESCRIPTION"}}],"versions":["release_v20260323_0-2.0","release_v20260319_0-2.x","release_v20260319_0-2.0","release_v20260317_0-2.x","release_v20260312_0-2.x","release_v20260310_1-2.x","fw-2.1.0","release_v20260310_0-2.x","release_v20260303_0-2.0","release_v20260218_0-2.x","release_v20260217_0-2.x","release_v20260214_0-2.x","release_v20260210_0-2.0","fw-2.0.1","rom-2.0.1","release_v20260209_0-2.0","release_v20260208_0-2.0","rom-2.1.0","release_v20260207_1-2.x","release_v20260207_0-2.x","release_v20260207_0-2.0","release_v20260120_0-2.0","release_v20251204_0-2.x","release_v20251203_0-2.x","release_v20251128_0-2.x","release_v20251126_0-2.x","release_v20251125_1-2.x","fw-2.0.0","release_v20251125_0-2.x","release_v20251122_0-2.x","rom-2.0.0","release_v20251121_0-2.x","release_v20251120_1-2.x"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11836.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}