Early attestation bugs crack Cocos AI and Contrast TLS claims

Three critical vulnerabilities in early attestation for attested TLS have been disclosed in two confidential computing products marketed as highly secure, researchers Muhammad Usama Sardar and Songbo Bu report.

Under the label EarlyAttestationBleed, the issues all score CVSS 9.0 or higher. Two hit Ultraviolet's Cocos AI attested TLS path, previously cast as a leading Confidential Computing Consortium offering. Those are CVE-2026-92701 and CVE-2026-92702, each rated 9.1. The third, CVE-2026-100833 at 9.6, affects Edgeless Systems Contrast. Edgeless had taken second place this year in WirtschaftsWoche's Best of Technology cybersecurity category.

Attested TLS is meant to bind remote attestation evidence into the handshake so a peer can trust not only the channel but that code is running in the claimed confidential environment. Flaws at that binding undermine the security story those products sold to operators who rely on confidential computing for isolation guarantees.

The team combined ProVerif models with implementation regression tests, then coordinated responsible disclosure with maintainers. Cocos AI has shifted to post-handshake attestation. Edgeless still ships early attestation.

Findings were presented to the IRTF Usable Formal Methods Research Group and in related ASIA CCS 2026 work on identity failures in attested TLS. The authors tie the results to long-standing calls, including from IETF SEAL chartering, for clearer operational guidance on attested TLS. An updated paper revision is public; further complexity analysis is slated for separate work.