CVE-2026-22696: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22696 is a critical cryptographic verification bypass vulnerability in the dcap-qvl library (Data Center Attestation Primitives Quote Verification Library) developed by Phala Network. The flaw allows an unauthenticated remote attacker to forge QE (Quoting Enclave) Identity data, effectively bypassing Intel SGX and TDX remote attestation. Affected packages include @phala/dcap-qvl (npm ≤ 0.3.0), @phala/dcap-qvl-node (npm ≤ 0.3.3), @phala/dcap-qvl-web (npm ≤ 0.3.3), dcap-qvl (Rust/Cargo < 0.3.9), and dcap-qvl (pip < 0.3.9). The vulnerability was published on January 24, 2026, and carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is classified under CWE-295 (Improper Certificate Validation) and CWE-347 (Improper Verification of Cryptographic Signature). The dcap-qvl library fetches QE Identity collateral — including qe_identity, qe_identity_signature, and qe_identity_issuer_chain — from the Provisioning Certificate Caching Service (PCCS), but critically omits verification of the qe_identity_signature against the issuer certificate chain. Additionally, the library fails to enforce required policy constraints (MRSIGNER, ISVPRODID, ISVSVN) on the QE Report. No privileges, user interaction, or special preconditions are required for exploitation — an attacker only needs network access to a system relying on the vulnerable library for quote verification (GitHub Advisory, Phala Advisory).

Successful exploitation completely undermines the remote attestation security model for Intel SGX and TDX environments. An attacker can forge QE Identity data to whitelist a malicious or non-Intel Quoting Enclave, then use that forged QE to sign arbitrary, untrusted quotes that the verifier will accept as legitimate. This means a verifier can no longer distinguish between genuine trusted execution environments and attacker-controlled ones, exposing high-integrity workloads — such as confidential computing, secure enclaves, and privacy-preserving applications — to both confidentiality and integrity compromise. All deployments using dcap-qvl for SGX or TDX quote verification are affected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.016% (1st percentile), indicating a currently low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the low attack complexity and lack of authentication requirements make it a high-priority patching target for confidential computing deployments.

1. Identify target: Locate a service or application that uses dcap-qvl (npm, Rust, or Python) in a version prior to 0.3.9 for SGX or TDX quote verification.
2. Intercept or control PCCS responses: Position the attack to supply or manipulate the QE Identity collateral (qe_identity, qe_identity_signature, qe_identity_issuer_chain) returned from the PCCS to the vulnerable verifier — for example, via a man-in-the-middle attack or a rogue PCCS endpoint.
3. Forge QE Identity data: Craft malicious qe_identity JSON that whitelists an attacker-controlled or non-Intel Quoting Enclave by setting desired MRSIGNER, ISVPRODID, and ISVSVN values, since the library does not validate the signature or enforce these policy fields.
4. Generate forged quotes: Use the attacker-controlled Quoting Enclave (now whitelisted) to sign arbitrary SGX/TDX quotes for untrusted or malicious workloads.
5. Submit forged quotes: Present the forged quotes to the target verifier; because the library accepts the manipulated QE Identity without cryptographic validation, the quotes pass verification and the attacker's workload is treated as a trusted enclave (GitHub Advisory, Phala Advisory).

• Network: Unexpected or unauthorized PCCS endpoints responding to QE Identity collateral requests; unusual outbound connections from attestation services to non-standard PCCS URLs.
• Logs: Attestation verification logs showing successful quote verification for enclaves with unexpected or unknown MRSIGNER, ISVPRODID, or ISVSVN values; absence of signature validation errors where they would normally be expected.
• File System: Presence of dcap-qvl npm, Rust, or Python packages at versions ≤ 0.3.0 (npm), ≤ 0.3.3 (dcap-qvl-node/dcap-qvl-web), or < 0.3.9 (Rust/pip) in deployed environments.
• Process Behavior: Attestation services accepting quotes from enclaves not matching known-good Intel QE identity values; workloads running in enclaves that cannot be traced to legitimate Intel-signed Quoting Enclaves.

The vulnerability is patched in dcap-qvl version 0.3.9 (Rust/Cargo and pip), which implements the missing cryptographic verification of the QE Identity signature and enforces MRSIGNER, ISVPRODID, and ISVSVN policy checks against the QE Report. For the npm ecosystem, users of @phala/dcap-qvl should upgrade to version 0.3.9; users of @phala/dcap-qvl-node and @phala/dcap-qvl-web (for which no patched versions exist) must migrate to the pure JavaScript implementation @phala/dcap-qvl. There are no known workarounds — upgrading to the patched version is the only remediation (GitHub Advisory, Phala Advisory).

The vulnerability was reported by security researcher Rahul Saxena of Blue Throat Labs (saxenism@bluethroatlabs.com) and published by Phala Network maintainer kvinwang on January 24, 2026 (Phala Advisory). The advisory was noted in infosec community channels including Mastodon (infosec.exchange) and Bluesky shortly after disclosure. Red Hat also tracked the CVE, indicating broader ecosystem awareness among enterprise Linux vendors (GitHub Advisory).