CVE-2026-6966

Published: Apr 24, 2026Modified: Jun 17, 2026

7.0

Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Affected (2)

Products: Amazon: Tough, Tuftool

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Amazon Tough	Before 0.22.0
Amazon Tuftool	Before 0.15.0

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (6)

https://aws.amazon.com/security/security-bulletins/2026-019-aws/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Vendor Advisory

https://crates.io/crates/tough/0.22.0

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Product

https://crates.io/crates/tuftool/0.15.0

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Product

https://github.com/awslabs/tough/releases/tag/tough-v0.22.0

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Release Notes

https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Release Notes

https://github.com/awslabs/tough/security/advisories/GHSA-8m7c-8m39-rv4x

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Vendor Advisory

Timeline

No history available yet.