CVE-2026-119345
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
39/100
Published: 2026-11-05
Modified: 2026-11-12
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
Present
VC:
High
VI:
High
VA:
None
Description
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| ultravioletrs | cocos | < 0.9.0 |
| ultravioletrs | cocos | < 0.9.0 |
References & Advisories (4)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM