Time-of-Check Time-of-Use Vulnerability in CCC Attestation SIG Attested TLS Product

CVE-2026-129092

What is CVE-2026-129092?

The CCC Attestation SIG's attested-tls-poc contains a time-of-check time-of-use (TOCTOU) vulnerability that arises from a faulty implementation of TLS handshake processes. During the TLS handshake, the system appraises evidence just once, allowing attackers with local access to the endpoint to manipulate workload code, configurations, or connected devices, including GPUs, without detection. The lack of post-handshake re-attestation compromises the system's integrity while keeping peers reliant on the original evidence. This exposure can lead to severe security risks if not adequately addressed.

References