{"id":"CVE-2026-129092","summary":"CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only Attestation","details":"CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence.","modified":"2026-11-14T02:47:33.278507079Z","published":"2026-11-13T15:11:13.522Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-367"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129092.json"},"references":[{"type":"ARTICLE","url":"https://doi.org/10.1145/3779208.3785387"},{"type":"PACKAGE","url":"https://github.com/CCC-Attestation/attested-tls-poc"},{"type":"ARTICLE","url":"https://github.com/CCC-Attestation/formal-spec-id-crisis"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129092.json"},{"type":"ARTICLE","url":"https://github.com/ionut-arm/mbedtls/blob/f4ac7593826a506fc509c83cad73786acab1d442/library/ssl_tls13_generic.c#L430-L436"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129092"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ccc-attestation-sig-attested-tls-poc-through-commit-731ca82-toctou-via-handshake-only-attestation"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/CCC-Attestation/attested-tls-poc","events":[{"introduced":"0"},{"last_affected":"731ca82ed533fc7a1092be980887ae2e34261da2"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"731ca82ed533fc7a1092be980887ae2e34261da2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129092.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}