CVE-2026-11836: Production Debug-Unlock Token Verification Missing Device Binding
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.1%
EPSS score, percentile 1.2 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 1.8 Low
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 2.0.0 through 2.0.2
- 2.1.0 through 2.1.1
- 2.0.0 through 2.0.1
- 2.1.0
Unaffected 2.0.3; 2.1.2; 2.0.2; 2.1.1
Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 2.0.0 through 2.0.2 |
| Unaffected | 2.0.3 |
| Affected | 2.1.0 through 2.1.1 |
| Unaffected | 2.1.2 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 2.0.0 through 2.0.1 |
| Unaffected | 2.0.2 |
| Affected | 2.1.0 |
| Unaffected | 2.1.1 |
Versions not listed are: unaffected.
Versions the record lists as unaffected: 2.0.3, 2.1.2, 2.0.2, 2.1.1.
Source: CVE List, as of . About the data.
About this vulnerability
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce contin…
Summary: CVE record, as of .
- CISA has not added CVE-2026-11836 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
- The CVE record was published on 4 Aug 2026.
- The CVE record carries a CVSS v4.0 base score of 1.8 (Low), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.1% (percentile 1.2), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
- CISA's SSVC assessment in the CVE record: exploitation none, automatable no, technical impact partial.
- The credits in the CVE record name Anthropic (Claude) as finder.
Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.
Description
Production Debug-Unlock Token Verification Missing Device Binding
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Source: CVE List, as of . About the data.
Weakness
CWE-345, 1 CAPEC
- CWE-345: Insufficient Verification of Data Authenticity
Attack patterns (CAPEC)
- CAPEC-115: Authentication Bypass
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published |