Confidence in secure clouds begins with a question to whom the data is actually sent, and a new formal check showed that the Attested TLS protocol is not always able to give the right answer.
Attested TLS combines a secure TLS connection with remote certification. The server must cryptographically prove to the client that works within a genuine and unchanged trusted environment. Specialists from Dresden University, IBM and University of Namur checked Seven ways to link such proof to a connection and found that none prevents traffic relays.
In case of such an attack, the client receives the correct confirmation from the trusted server or AI agent, but then encrypts the data for another malicious system. The protocol checks the integrity of the software environment, but does not reliably link the verification with a specific server and the key that protects user data after the connection is installed.
The authors tested not only theoretical models, but also four existing implementations. The disadvantage was found in Private Processing for WhatsApp, Contrast, Cocos AI and the demonstration project of the Confidential Computing Consortium group. For Cocos AI, versions are vulnerable from 0.4.0 to 0.8.2. Information about attacks on real systems, the source does not provide.
Vulnerability received the number CVE-2026-33697 and a score of 7.5 out of 10 on the CVSS 3.1 scale (AV:L/AC/C/H/C:H/H/A:N/C:C/I:A:N). The method of protection offered by the authors confirms the correct server only at an early stage of the connection, but does not guarantee that subsequent data will continue to enter the same system. In other words, complete protection now simply does not exist.
Developers are advised to opt out of certification during the connection installation and switch to a check after the handshake is completed, when the data transfer key has already been created.
Attested TLS combines a secure TLS connection with remote certification. The server must cryptographically prove to the client that works within a genuine and unchanged trusted environment. Specialists from Dresden University, IBM and University of Namur checked Seven ways to link such proof to a connection and found that none prevents traffic relays.
In case of such an attack, the client receives the correct confirmation from the trusted server or AI agent, but then encrypts the data for another malicious system. The protocol checks the integrity of the software environment, but does not reliably link the verification with a specific server and the key that protects user data after the connection is installed.
The authors tested not only theoretical models, but also four existing implementations. The disadvantage was found in Private Processing for WhatsApp, Contrast, Cocos AI and the demonstration project of the Confidential Computing Consortium group. For Cocos AI, versions are vulnerable from 0.4.0 to 0.8.2. Information about attacks on real systems, the source does not provide.
Vulnerability received the number CVE-2026-33697 and a score of 7.5 out of 10 on the CVSS 3.1 scale (AV:L/AC/C/H/C:H/H/A:N/C:C/I:A:N). The method of protection offered by the authors confirms the correct server only at an early stage of the connection, but does not guarantee that subsequent data will continue to enter the same system. In other words, complete protection now simply does not exist.
Developers are advised to opt out of certification during the connection installation and switch to a check after the handshake is completed, when the data transfer key has already been created.
