# CVE-2026-119345: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- ultravioletrs / cocos: < 0.9.0 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 4.0: 7.2 (high); CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-367

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/ultravioletrs/cocos/security/advisories/GHSA-ghwv-vrp2-2975 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/ultravioletrs/cocos/pull/582 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/ultravioletrs/cocos/commit/80bf813c48300f02259b338b91f844c71be582ea (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-119345; retrieved 2026-11-05; source updated 2026-11-05

Revision: 4a627b90cd1eafd2d1dcf7ead52ea137d1052ed790c3da9e180d5ea480840aea

Canonical: https://y2.dev/cve/CVE-2026-119345

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.