Intra-handshake TLS Vulnerability in Cocos AI Confidential Computing by Ultravioletrs

CVE-2026-92702

What is CVE-2026-92702?

Cocos AI, a platform designed for running AI workloads within secure environments, has a vulnerability in its intra-handshake attested TLS (aTLS) verification mechanism. This issue affects versions up to and including 0.8.2. The flaw occurs due to the lack of enforcement for attestation freshness when the expected reportData is nil, empty, or omitted. As a result, this oversight allows the SEV-SNP policy ReportData to remain unset, enabling a verifier to accept stale or unrelated evidence that is not properly bound to the current connection. Consequently, a relying party may mistakenly trust an unintended attestation context. However, it is important to note that if a non-empty reportData is supplied, it will still be validated. This vulnerability was addressed and resolved in version 0.9.0.

References