Auth bypass in Caliptra Core Runtime Firmware
CVE-2026-7328
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0.
Vulnerability class: Broken Access Control
EPSS: 0.001 (3.0th percentile) — read the EPSS interpretation.
Affected products
- Caliptra Core Runtime Firmware — versions 2.1.0, 2.1.1