CVE-2026-92701

CriticalCVSS 9.1

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Summary

Cocos AI up to version 0.8.2 has a vulnerability in the aTLS verification path for Intel TDX where the expected freshness value is not copied into the quote-body policy before validation. This allows acceptance of evidence with mismatched or reused reportData, potentially leading to session misbinding.

Risk Assessment

A relying party using this path can accept evidence with mismatched reportData and release application data after the handshake, potentially leading to data confidentiality compromise.

Recommendation

Upgrade Cocos AI to version 0.9.0 or later. Ensure the expected reportData is correctly copied into the policy.

Other vulnerabilities in Cocos AI

CVE-2026-92702Critical
Cocos AI up to version 0.8.2 has a vulnerability in the aTLS verification path for AMD SEV-SNP where attestation freshness is not enforced when the expected reportData is nil, empty, or omitted. This allows acceptance of unrelated or stale evidence, potentially leading to trust in an unintended attestation context.

Original NVD description (English source)

trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body policy before quote validation, so structurally valid TDX QuoteV4 Evidence is accepted without checking that its REPORT_DATA field matches the reportData expected for the current session. A relying party using this path can therefore accept Evidence with a mismatched or reused reportData and release application data after the handshake, enabling session-misbinding to an unintended attestation context. The issue is fixed in version 0.9.0.