CVE-2026-129092

CVSS 7.0 (high) · published 2026-11-13

CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence.

Weakness: CWE-367

Source: NVD CVE-2026-129092

References

• https://doi.org/10.1145/3779208.3785387
• https://github.com/CCC-Attestation/attested-tls-poc
• https://github.com/CCC-Attestation/formal-spec-id-crisis
• https://github.com/ionut-arm/mbedtls/blob/f4ac7593826a506fc509c83cad73786acab1d442/library/ssl_tls13_generic.c#L430-L436
• https://www.vulncheck.com/advisories/ccc-attestation-sig-attested-tls-poc-through-commit-731ca82-toctou-via-handshake-only-attestation

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.