CVE-2026-92702: Cocos AI aTLS Authentication Bypass Vulnerability

CVE-2026-92702 Overview

CVE-2026-92702 affects Cocos AI, a confidential computing system for running AI workloads inside trusted execution environments. The vulnerability resides in the intra-handshake attested TLS (aTLS) AMD SEV-SNP verification path. When the expected reportData value is nil, empty, or omitted, the verifier fails to enforce attestation freshness. This leaves the SEV-SNP policy ReportData unset, allowing the verifier to accept unrelated or stale Evidence not bound to the current connection. A relying party using this path for trust or authorization decisions can be induced to trust an unintended attestation context. The issue is classified under [CWE-346] Origin Validation Error and is fixed in version 0.9.0.

Critical Impact
Attackers can present stale or unrelated SEV-SNP attestation Evidence to relying parties, undermining the confidential computing trust model and enabling authentication bypass in AI workload environments.

Affected Products

Cocos AI versions up to and including 0.8.2
Ultraviolet Cocos aTLS SEV-SNP verification path
Confidential AI workload deployments relying on intra-handshake aTLS

Discovery Timeline

2026-09-18 - CVE-2026-92702 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-92702

Vulnerability Analysis

Cocos AI implements attested TLS to bind SEV-SNP attestation Evidence to a TLS session. The ReportData field in an SEV-SNP attestation report normally carries a nonce or session-binding value tied to the current connection. The intra-handshake aTLS verification path in Cocos AI versions ≤ 0.8.2 skips freshness enforcement when the expected reportData argument is nil, empty, or omitted. In this state, the SEV-SNP policy ReportData remains unset, so the verifier does not compare the attestation's ReportData against any session-bound value. A properly supplied non-empty reportData continues to be validated correctly.

Root Cause

The root cause is an origin validation flaw [CWE-346] in the aTLS handshake code path. Freshness checks depend on caller-supplied expected values rather than a mandatory session-derived nonce. When callers omit the value, the check silently degrades to accepting any structurally valid Evidence, including replayed reports from prior sessions or unrelated confidential VMs.

Attack Vector

A network-adjacent attacker who can present or replay a valid SEV-SNP attestation to a Cocos AI relying party can induce trust in an unintended attestation context. This does not require authentication or user interaction. The impact extends to confidentiality and integrity of AI workload data processed inside what the relying party believes to be a verified enclave.

// Security patch in pkg/atls/ea/certificate.go
// Post-handshake aTLS (#582) restructures attestation binding
package ea

type CertificateMessage struct {
	Context []byte
	Entries []CertificateEntry
}

type CertificateEntry struct {
	CertDER    []byte
	Extensions []Extension
}

func (m CertificateMessage) Marshal() ([]byte, error) {
	if len(m.Context) > 255 {
		return nil, ErrInvalidLength
	}

	var listPayload []byte
	for _, e := range m.Entries {
		if len(e.CertDER) == 0 || len(e.CertDER) > 0xFFFFFF {
			return nil, ErrInvalidLength
		}
		extVec, err := MarshalExtensions(e.Extensions)
		if err != nil {
			return nil, err
		}
		entry := make([]byte, 3+len(e.CertDER)+len(extVec))
	}
}

Source: GitHub Commit 80bf813. The patch restructures aTLS to a post-handshake certificate exchange model that binds Evidence to session context by construction.

Detection Methods for CVE-2026-92702

Indicators of Compromise

SEV-SNP attestation reports presented during aTLS handshakes with a zero-filled or absent ReportData field.
Repeated presentation of identical attestation Evidence across distinct TLS sessions to a Cocos relying party.
Cocos AI service processes running versions ≤ 0.8.2 exposed to untrusted network segments.

Detection Strategies

Audit application code and configuration for aTLS verifier invocations that omit or pass empty reportData values.
Instrument the aTLS handshake path to log the expected reportData value and the attestation's ReportData for every verification.
Correlate attestation report hashes across sessions to detect replay of stale Evidence.

Monitoring Recommendations

Monitor Cocos AI service logs for successful handshakes lacking session-bound nonce validation.
Alert on any deployment still running Cocos versions at or below 0.8.2.
Track outbound and inbound connections to confidential VMs handling AI workloads for anomalous handshake patterns.

How to Mitigate CVE-2026-92702

Immediate Actions Required

Upgrade Cocos AI to version 0.9.0 or later, which contains the post-handshake aTLS fix from Pull Request #582.
Audit all relying-party code to ensure a non-empty, session-unique reportData is passed to every aTLS verification call until the upgrade completes.
Rotate any trust decisions or authorization tokens issued based on aTLS verifications performed by vulnerable versions.

Patch Information

The fix is available in Cocos AI 0.9.0. Refer to the GitHub Release v0.9.0 and the GitHub Security Advisory GHSA-4r6g-mp48-j2rw for full details. The remediation restructures the aTLS handshake so attestation Evidence is bound to session context and freshness enforcement no longer depends on caller-supplied optional arguments.

Workarounds

Always supply a cryptographically random, per-session reportData value to the aTLS verifier when invoking the intra-handshake path.
Restrict network exposure of Cocos AI services to trusted peers only until patched.
Terminate aTLS at a hardened proxy that enforces nonce binding independently of the vulnerable verifier path.

bash

# Upgrade Cocos AI to the patched release
git clone https://github.com/ultravioletrs/cocos.git
cd cocos
git checkout v0.9.0
make build

# Verify installed version
./build/cocos-agent --version