Attested TLS in the CoCoS system permits an attacker to extract the temporary private key used during the TLS handshake. This is a cryptographic key‑compromise weakness (CWE‑322) and also involves an unchecked transfer of credentials (CWE‑346). With the key, an attacker can relay or divert an attested TLS session, making a client accept a connection to a false endpoint while the attestation report cannot differentiate the genuine attested service. The result is a breach of the authentication guarantees of attested TLS, allowing the attacker to impersonate a CoCoS service and obtain or tamper with data intended for the legitimate endpoint.

The vulnerability affects ultravioletrs CoCoS versions from v0.4.0 through v0.8.2 on both AMD SEV‑SNP and Intel TDX deployment targets.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to retrieve the temporary TLS key, which can be achieved through physical access to the server hardware, transient‑execution attacks, or side‑channel attacks. The likely attack vector is therefore either compromised physical security or advanced side‑channel techniques. No patch is currently available.