CVE-2026-6967
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.25% probability · 16th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-345
- Affected
- amazon/tough · amazon/tuftool
- Source
- ff89ba41-3aa1-4d27-914a-91399e9639e5
References
- https://aws.amazon.com/security/security-bulletins/2026-019-aws/Vendor Advisory
- https://crates.io/crates/tough/0.22.0Product
- https://crates.io/crates/tuftool/0.15.0Product
- https://github.com/awslabs/tough/releases/tag/tough-v0.22.0Release Notes
- https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0Release Notes
- https://github.com/awslabs/tough/security/advisories/GHSA-4v58-8p28-2rq3Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.