High, CVSS 7.2GoAmendedPublished
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
CVE-2026-119345 · GHSA-ghwv-vrp2-2975
- Affected
- Go github.com/ultravioletrs/cocos < 0.9.0
- Fixed in
- 0.9.0· Vendor fix available
- Issue
- An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were still running. Details Once attestation is successfully appraised and connection is established, there is a window of vulnerability from the establishment of connection to the termination of connection where an attacker can modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. Workload state includes code, data, and configuration. Other examples of state changes at the workload level include cases where a new device (such as a GPU) is connected, or where a connected device is disconnected, since the connection establishment. In Cocos AI, there is no mechanism for the peer to know that some state has changed in the Attester after the…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.