CVE-2026-119344

Name of the Vulnerable Software and Affected Versions Cocos AI versions prior to 0.9.0

Description Cocos AI is a confidential computing system for AI. The intra-handshake attested TLS implementation is susceptible to diversion attacks. The system accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, but fails to bind the Evidence to an allowed platform owner or unique machine identity and does not enforce revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform to cause the authorization of the wrong platform.

Recommendations Update to version 0.9.0.