Intel TDX MigTD: missing authentication step in SPDM rebind lets an adjacent attacker run code

CVSS 9.4CVE-2026-61887Firmware, BMC & network fabriccurated

Impact

MigTD is the service TD that authenticates the peer platform and transfers keys during live migration of Intel TDX confidential VMs. Its SPDM rebind code skips a step it needs to authenticate the peer. Intel says an unauthenticated adversary on the adjacent network could get code execution and privilege escalation, with high confidentiality, integrity and availability impact on MigTD and on the systems that rely on it. On a confidential-GPU fleet, a compromised MigTD can expose or tamper with the migration keys that protect tenant TDs, which defeats the isolation TDX promises tenants. Only hosts that run MigTD for TD live migration are exposed. The record does not give exploit details or say which MigTD versions are affected.

Who can reach it

An unauthenticated adversary on the adjacent network that carries the MigTD migration and SPDM session traffic. No user interaction, low complexity. Only relevant where TDX live migration with MigTD is enabled.

What to do

Apply the MigTD update named in Intel advisory INTEL-SA-01580. The record does not give a fixed version or the rollout steps. Until it is patched, keep migration traffic on an isolated, trusted network segment, or disable TD live migration where you can. Rollout cost depends on how your VMM stack ships the MigTD image. Check with your platform or hypervisor vendor.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61887 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.