CVE-2026-11836

unknowncovered by 1 sourcefirst seen 2026-08-04

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.

⚡ Watch CVE-2026-11836

Get an email if CVE-2026-11836 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-11836: Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validat…nvd · 2026-08-04

External references

NVD record for CVE-2026-11836

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-11836 status](https://www.csirts.com/badge/CVE-2026-11836)](https://www.csirts.com/cve/CVE-2026-11836)