Confidential Computing Vulnerability in Cocos AI by Ultravioletrs

CVE-2026-119345

What is CVE-2026-119345?

Cocos AI, a confidential computing platform, exhibits a critical flaw in its attestation mechanism. Prior to version 0.9.0, the system performs attestation only once when a secure TLS connection is formed. An attacker with the ability to manipulate the workload code, state, or configuration of the attester can keep a connection active while the peer relies on outdated and potentially compromised evidence. This weakness poses a significant risk for long-lived connections, as the verification process lacks the ability to detect any alterations made after the initial attestation check. This vulnerability has been addressed in version 0.9.0, which implements improved mechanisms to ensure the integrity of long-term connections.

References