CVE-2026-119345

Name of the Vulnerable Software and Affected Versions Cocos AI versions prior to 0.9.0

Description Cocos AI performs attestation only once during the establishment of an attested TLS connection. This allows an attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after the initial check to maintain an open connection. Consequently, the peer continues to trust stale initial Evidence, as the verifier lacks a mechanism to detect state changes, which is particularly critical for long-lived connections.

Recommendations Update to version 0.9.0.