Attested TLS Flaw Undermines Confidential Computing Remote Attestation

Academic researchers disclosed a fundamental weakness in attested TLS, the remote attestation mechanism used by confidential computing platforms to prove a server is running inside a trusted execution environment (TEE). The team, led by Muhammad Usama Sardar of TU Dresden, found that current intra-handshake attestation designs do not securely bind attestation evidence to the actual TLS connection, enabling relay or diversion attacks in which a client validates a genuine attested server or AI agent but unknowingly sends encrypted traffic to a different malicious machine. The issue has been assigned CVE-2026-33697 and rated high severity.

The researchers formally analyzed seven cryptographic binding approaches and reported that none prevented this attack class, raising concerns that stronger “level-three” binding may be unattainable within the current architecture. Reported affected implementations include Meta’s Private Processing for WhatsApp, Edgeless Systems’ Contrast, Cocos AI, and a Confidential Computing Consortium proof of concept. Standards groups including the IETF SEAT and TLS working groups have acknowledged the findings, while the researchers recommended moving away from intra-handshake attestation toward post-handshake attestation as a safer alternative.