Cocos AI is a confidential computing system for AI. In releases 0.8.2 and earlier, the AMD SEV‑SNP verifier component VerifyAttestationReportTLS assigns Policy.ReportData only when the caller supplies a non‑empty expected reportData. If the expected reportData is nil or empty, the verifier still accepts the received evidence, which can be unrelated to the current connection, potentially allowing an attacker to obtain trust, authorization, or data release for an unintended attestation context. This flaw, identified as CWE‑346, enables bypassing the freshness check and gaining unauthorized trust or privilege over the system. The issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path during the migration to post‑handshake attestation.

The flaw affects the Cocos AI confidential computing system from Ultravioletrs. Versions up to and including 0.8.2 are impacted. A fix was introduced in version 0.9.0, which enforces the required reportData presence and validity.

With a CVSS score of 9.1 the vulnerability is classified as critical. The EPSS score is below 1 %, indicating a low but non‑zero probability of exploitation in the wild. The issue is not yet listed in the CISA KEV catalog, but due to the high severity an attacker could attempt exploitation via a remote network connection establishing an attested TLS session. The exploit would require an attacker to supply evidence that bypasses the missing reportData verification, thereby inducing the system to accept a stale or unrelated attestation.