CVE-2026-6967

216.73.216.133

· Published 24/04/2026 20:16 · Modified 24/04/2026 21:16

Labels: CVE-2026-6967 2026-04-24 CVE-2026-6967 CWE-345 ff89ba41-3aa1-4d27-914a-91399e9639e5

Essential information

Published: 24/04/2026 20:16
Modified: 24/04/2026 21:16
Author: —
Creator: —
CVSS: 7.1 HIGH (v3) 7.1 HIGH (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD: View on NVD

Affected products (CPE)

Product	CPE
awslabs / tough	`cpe:2.3:a:awslabs:tough:<0.22.0:::::::*`
awslabs / tuftool	`cpe:2.3:a:awslabs:tuftool:0.15.0:::::::*`