Missing Delegated Metadata Validation in awslabs/tough · Advisory · awslabs/tough · GitHub

Vulnerability Overview Title: Missing Delegated Metadata Validation in awslabs/tough Severity: Moderate (5.9 / 10) CVE ID: CVE-2026-6967 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: Low Description: In the awslabs/tough library, versions of prior to 0.22.0 and prior to 0.15.0 contain a missing delegated metadata validation issue. This vulnerability allows a remote authenticated user with delegated signing privileges to bypass TUF specification integrity checks, thereby injecting malicious metadata into the local metadata cache, because does not apply the same validation checks to top-level targets. --- Impact Scope Affected Versions: : 0.9.0 to 0.21.x : < 0.15.0 Impact: The library fails to properly validate delegated target metadata, enabling an attacker to inject expired or invalid targets into the TUF repository, causing to trust and load these malicious targets. --- Remediation Patched Versions: : 0.22.0 : 0.15.0 Recommendation: Upgrade to the patched versions listed above, and ensure that all derived code also applies the same fixes. Workaround: No known workaround is currently available. --- References CVE-2026-6967 Contact the [AWS/Amazon] security team to report vulnerabilities: vulnerability reporting page or email aws-security@amazon.com. Do not create public GitHub Issues. --- Acknowledgments Thanks to Oleh Konko from 1seal for collaborating on this issue during the coordinated vulnerability disclosure process.

Goal Reached Thanks to every supporter — we hit 100%!

Missing Delegated Metadata Validation in awslabs/tough · Advisory · awslabs/tough · GitHub

More from this source