GHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Summary

Cocos AI's intra-handshake attested TLS implementation performs attestation only once, at connection establishment, so the verifying peer keeps trusting the initial Evidence for the life of a connection. An attacker who can modify the attested workload's code, memory-backed state, or configuration after attestation, without terminating the TLS connection, can make the peer treat stale state as current. The flaw is especially concerning for long-lived connections. Muhammad Usama Sardar found and responsibly disclosed it through formal analysis using ProVerif.

Mitigation

The proposed workaround is to allow re-attestation of the workload after periodic or user-defined intervals using post-handshake attestation.

Related items

• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• MediumGHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolationSimilar attack · GitHub Advisory Database
• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• InfoSuppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor DefenseSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)