CVE-2026-119344

Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself.

• CWE-346

• https://dl.acm.org/doi/10.1145/3779208.3785387
• https://doi.org/10.1145/3779208.3785387
• https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0
• https://github.com/ultravioletrs/cocos/security/advisories/GHSA-v5m8-5wxc-vjgp
• https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/platform-ownership-endorsements.html

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119339Tesseract is an open source OCR engine. Prior to 5.5.4, Weig…5.5
• CVE-2026-11934IBM Verify Identity Access could allow an administrator to e…7.2
• CVE-2026-119340Tesseract is an open source OCR engine. Prior to 5.5.4, GENE…5.5
• CVE-2026-119341Tesseract is an open source OCR engine. Prior to 5.5.4, Read…0
• CVE-2026-119342Stirling-PDF is a locally hosted web application that facili…5.3
• CVE-2026-119343Stirling-PDF is a locally hosted web application that facili…6.8
• CVE-2026-119345Cocos AI is a confidential computing system for AI. Prior to…7.2
• CVE-2026-11936IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…5.4
• CVE-2026-119364ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 conta…5.3
• CVE-2026-119365Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-119366Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-119367Missing Authorization vulnerability in Liquid Web / StellarW…5.4