# CVE-2026-119344: Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- ultravioletrs / cocos: <= 0.8.2 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 4.0: 9.1 (critical); CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-346

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/ultravioletrs/cocos/security/advisories/GHSA-v5m8-5wxc-vjgp (CNA: GitHub_M; x_refsource_CONFIRM)

- https://dl.acm.org/doi/10.1145/3779208.3785387 (CNA: GitHub_M; x_refsource_MISC)

- https://doi.org/10.1145/3779208.3785387 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0 (CNA: GitHub_M; x_refsource_MISC)

- https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/platform-ownership-endorsements.html (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-119344; retrieved 2026-11-05; source updated 2026-11-05

Revision: ab0295c8fb0b0f7406a51a6f3f4f03c5255f9a10eb8c8ec5ce40d560aface6b2

Canonical: https://y2.dev/cve/CVE-2026-119344

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.