Loading vulnerability…
Relay attack in Cocos AI attested TLS (aTLS)
CVE-2026-33697 is an architectural weakness in Cocos AI's attested TLS (aTLS) implementation affecting all versions from v0.4.0 through v0.8.2, including both AMD SEV-SNP and Intel TDX deployment targets. During intra-handshake attestation, the attestation evidence is bound to the ephemeral TLS key, but not to the full TLS channel or application-data channel. If an attacker can obtain the ephemeral TLS private key used for that handshake, the attacker can relay or divert the session while presenting valid attestation evidence originating from the genuine attested service. As a result, the client accepts the connection under false assumptions about the endpoint identity: the attestation proves properties of a genuine attested service, but does not distinguish that service from an attacker-controlled relay endpoint. The issue is described as architectural and remains present despite the aTLS redesign introduced in v0.7.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation undermines the authentication guarantees that aTLS is intended to provide. An attacker can impersonate an attested CoCoS service by relaying or diverting a session after obtaining the ephemeral TLS private key, causing the client to send sensitive requests or data to an attacker-controlled endpoint while believing it is communicating with the genuine attested service. This can enable unauthorized access to data and operations intended only for the legitimate attested endpoint, and defeats trust decisions based on TEE attestation.
If you can’t patch tonight, do this now.
No complete workaround is available. The provided hardening measures only reduce exposure: keep TEE firmware and CPU microcode current to reduce the key-extraction attack surface; enforce strict attestation policy validation across all available report fields, including firmware versions, TCB levels, and platform configuration registers; and enable mutual aTLS with CA-signed certificates where the deployment architecture permits. These measures do not eliminate the relay/diversion weakness.
Patch, then assume compromise.
As of the provided content, no patch is available. The vulnerability is architectural and affects all CoCoS releases from v0.4.0 to v0.8.2, including the redesigned aTLS implementation introduced in v0.7.0. A complete remediation would require redesigning the attestation/channel-binding model so that attestation is securely bound to the TLS channel or application-data channel rather than only to the ephemeral handshake key; however, the supplied content does not provide a vendor-issued fixed version.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.