Cocos AI - attested TLS (aTLS) on AMD SEV-SNP and Intel TDX: The attested-TLS implementation is vulnerable to a relay

CVSS 7.5CVE-2026-33697Firmware, BMC & network fabricCoCoS aTLS relaycurated

Impact

The attested-TLS implementation is vulnerable to a relay attack in which an attacker extracts the ephemeral TLS private key used during the intra-handshake attestation, letting them relay a genuine attestation report from a real confidential VM while terminating the session themselves. Affects both the SEV-SNP and TDX deployment targets. The point of confidential AI is that the client can prove it is talking to a specific attested enclave; a relay attack means that proof is worth nothing while the transport still looks correct.

Who can reach it

A network attacker positioned between the client and the confidential workload. No credentials needed - the attack is against the binding between the attestation and the TLS session, not against either one alone.

What to do

Upgrade Cocos past v0.8.2. The broader operator lesson is worth more than the patch: any attested-TLS design that does not cryptographically bind the attestation report to the exact TLS key in use is relayable, so if you build or buy a confidential-AI stack, make binding an explicit acceptance criterion. Cost: application upgrade and redeploy; no firmware or driver change.

References

https://github.com/ultravioletrs/cocos/security/advisories/GHSA-vfgg-mvxx-mgg7 https://nvd.nist.gov/vuln/detail/CVE-2026-33697

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.