Answer in brief
CVE-2026-11836 records a Low severity (CVSS 1.8) vulnerability in Production Debug-Unlock Token Verification Missing Device Binding. The current sources do not mark it as known exploited. The current feed maps Caliptra/Core Firmware (generic), Caliptra/Core ROM (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 1.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Caliptra/Core Firmware (generic), Caliptra/Core ROM (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Caliptra/Core Firmwaregeneric | 2.0.0 || 2.1.0 | Not reported |
| Caliptra/Core ROMgeneric | 2.0.0 || 2.1.0 | Not reported |
Published upstream
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-11836 records a Low severity (CVSS 1.8) vulnerability in Production Debug-Unlock Token Verification Missing Device Binding. The current sources do not mark it as known exploited. The current feed maps Caliptra/Core Firmware (generic), Caliptra/Core ROM (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 1.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Caliptra/Core Firmware (generic), Caliptra/Core ROM (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Caliptra/Core Firmwaregeneric | 2.0.0 || 2.1.0 | Not reported |
| Caliptra/Core ROMgeneric | 2.0.0 || 2.1.0 | Not reported |
Published upstream
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0.
Quoted source text, attributed separately from HOL analysis.