Caliptra Core Runtime Firmware
CVE-2026-5818
HIGH
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent management interface (AV:A), requires firmware-update privileges (PR:H) and specific update-flow timing (AC:H); RoT bypass affects downstream MCU (S:C) with no confidentiality loss.
Primary rating from Vendor (Caliptra).
CVSS VectorVendor: Caliptra
Lifecycle Timeline
1DescriptionCVE.org
Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Core's verification of the MCU FW during a hitless update.
This issue affects Core Runtime Firmware: from 2.0.0 through 2.0.1, 2.1.0.
AnalysisAI
Firmware verification bypass in Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0 allows an attacker with high privileges to load unverified MCU firmware during a hitless update. The flaw resides in the ActivateFirmwareCmd::activate_fw module, where an incorrect check of a function return value causes the Root-of-Trust to skip authentication of the Microcontroller Unit firmware image. No public exploit identified at time of analysis, and the issue was responsibly disclosed by the Caliptra project itself.
Technical ContextAI
Caliptra is an open-source silicon Root-of-Trust (RoT) specification and reference implementation hosted under CHIPS Alliance, intended to provide measured boot, identity, and firmware attestation for datacenter SoCs. The Core Runtime Firmware runs inside the Caliptra RoT and is responsible for verifying downstream components - including the Microcontroller Unit (MCU) firmware - before allowing them to execute, particularly during hitless (no-reboot) update flows. CWE-253 (Incorrect Check of Function Return Value) applies here because the activate_fw routine evaluates the return code of an underlying verification call incorrectly, causing the failure path to be treated as success and signed-image enforcement to be silently skipped. The affected CPE is cpe:2.3:a:caliptra:core_runtime_firmware covering the 2.0.x and 2.1.0 branches.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - consult the Caliptra advisory at https://github.com/chipsalliance/caliptra-sw/security/advisories/GHSA-456r-gcjr-6rxq for the corrected firmware build and rebuild affected silicon firmware images from a fixed Core Runtime Firmware tag past 2.1.0. As a compensating control until patched firmware is deployed, disable the hitless update path and require full cold-boot updates so MCU firmware is re-verified through the standard boot-time measurement flow (trade-off: loss of zero-downtime update capability and operational disruption). Additionally, restrict which principals can issue ActivateFirmwareCmd to the RoT mailbox by tightening platform management access, and audit recent MCU firmware activations on affected builds for any unexpected images, since the bypass leaves no integrity signal once exercised.
More in Core Runtime Firmware
View allMissing authorization in Caliptra Core Runtime Firmware 2.1.0 exposes three mailbox command handlers - INVOKE_DPE_MLDSA8
Broken GCM integrity in Caliptra Core Runtime Firmware 2.0.0-2.1.0 allows an adjacent, low-privileged attacker to silent
Same weakness CWE-253 – Incorrect Check of Function Return Value
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today