CVE-2026-129092

Description

CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://doi.org/10.1145/3779208.3785387 ↗
• https://github.com/CCC-Attestation/formal-spec-id-crisis ↗
• https://github.com/ionut-arm/mbedtls/blob/f4ac7593826a506fc509c83cad73786acab1d442/library/ssl_tls13_generic.c#L430-L436 ↗
• https://github.com/CCC-Attestation/attested-tls-poc ↗
• https://www.vulncheck.com/advisories/ccc-attestation-sig-attested-tls-poc-through-commit-731ca82-toctou-via-handshake-only-attestation ↗