CVE-2026-119345 in Cocos AI
Summary
by MITRE • 11/05/2026
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified within Cocos AI prior to version 0.9.0 represents a critical failure in continuous attestation mechanisms, specifically affecting confidential computing environments designed for artificial intelligence workloads. Confidential computing relies on the principle that code and data remain encrypted even while being processed by the CPU, ensuring protection against threats from outside the hardware boundary. A core component of this trust model is remote attestation, where a verifier checks cryptographic evidence provided by an attester to confirm that the workload is running in a genuine secure environment with expected integrity levels. In versions earlier than 0.9.0, Cocos AI implemented a static approach to this process, performing the attestation check only once at the initial establishment of an Transport Layer Security connection. This design decision created a significant security gap where trust was established based on a single point-in-time snapshot rather than being maintained throughout the lifecycle of the communication session.
The technical flaw lies in the absence of periodic re-attestation or continuous integrity monitoring for long-lived connections. Once the initial TLS handshake is completed and verified, the system assumes that the state of the attester remains unchanged indefinitely. This assumption fails to account for dynamic threat scenarios where an attacker gains partial control over the environment after the connection is established. Specifically, if an adversary can modify the workload code, alter memory-backed state variables, change configuration files, or manipulate attached devices post-attestation, they can maintain a valid TLS session while operating in a compromised context. The verifier continues to trust the stale initial evidence because there was no mechanism to request updated proof of integrity during the active communication period. This effectively allows an attacker to bypass security controls by compromising the system after it has been deemed trustworthy but before the connection is terminated.
The operational impact of this vulnerability is severe, particularly in enterprise AI deployments where connections may persist for extended durations to handle complex model training or inference tasks. An attacker who exploits this flaw can potentially exfiltrate sensitive data processed within the confidential environment, inject malicious logic into the AI workflow, or use the compromised system as a pivot point for further attacks against other networked resources. Because the verifier has no mechanism to detect these changes in real-time, the integrity of the entire session is undermined without any alerting or disconnection events occurring automatically. This lack of continuous verification contradicts best practices for zero-trust architectures and secure multi-tenant environments where dynamic trust evaluation is required to mitigate insider threats and post-compromise attacks.
To address this issue, Cocos AI version 0.9.0 introduces enhanced attestation protocols that likely involve periodic re-validation or challenge-response mechanisms during the lifetime of a connection. Organizations relying on earlier versions should prioritize upgrading immediately to ensure continuous integrity verification aligns with modern security standards. From an industry classification perspective, this vulnerability maps closely to CWE-324, which describes the use of a key past its expiration date, as it involves trusting stale evidence beyond its valid temporal scope. Furthermore, it relates to ATT&CK technique T1059, Command and Scripting Interpreter, in contexts where attackers might leverage compromised confidential workloads for persistent access or lateral movement. Mitigation strategies must emphasize the implementation of continuous attestation frameworks that regularly validate the runtime environment against a known good baseline, ensuring that trust is dynamically maintained rather than statically assumed at connection initiation.