Threat database

CVE-2026-92701 is a critical origin validation vulnerability in Cocos AI versions 0.8.2 and earlier. The Intel TDX aTLS verifier's VerifTeeAttestation function fails to apply the expected current-session value to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. This allows acceptance of structurally valid but mismatched or reused REPORT_DATA, potentially causing trust or authorization decisions to be made for unrelated attestation contexts. The issue was fixed in version 0.9.0 by removing the affected verifier path during migration to post-handshake attestation.

CVE-2026-92702 is a critical origin validation error in Cocos AI versions before 0.9.0. The vulnerability involves improper handling of attestation report data in the AMD SEV-SNP verifier, allowing a relying party to accept attestation evidence unrelated to the current session when empty expected report data is provided. This can lead to incorrect trust, authorization, or data release decisions. The issue was fixed in version 0.9.0 by removing the affected verification path during migration to post-handshake attestation.

CVE-2026-33697 is a high-severity vulnerability in the attested TLS (aTLS) implementation of the CoCoS confidential computing system for AI, affecting versions 0.4.0 through 0.8.2. The vulnerability allows a relay attack due to the extraction of the ephemeral TLS private key during the intra-handshake attestation. This key extraction enables an attacker to impersonate an attested CoCoS service, undermining authentication guarantees and potentially exposing sensitive data or operations. Exploitation requires physical access or advanced side-channel or transient execution attacks. The vulnerability is architectural and affects both AMD SEV-SNP and Intel TDX deployments. No patch or complete workaround is currently available, though some hardening measures can reduce risk.