CVE-2026-23992
Medium · 5.9CVSS
5.9
EPSS
0.2%
Published
Jan 22, 2026
CISA due date
—
The record
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/theupdateframework/go-tuf/v2 | 0 | 2.3.1 |
| Chainguard | aactl | 0 | 0.4.12-r39 |
| Chainguard | buildkitd | 0 | 0.27.0-r1 |
| Chainguard | buildkitd-fips | 0 | 0.27.0-r1 |
| Chainguard | cg | 0 | 0.2.201-r0 |
| Chainguard | chainctl | 0 | 0.2.206-r0 |
| Chainguard | cloudbeat-8.17 | 0 | 8.17.10-r5 |
| Chainguard | cloudbeat-8.18 | 0 | 8.18.8-r5 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.10-r0 |
| Chainguard | cloudbeat-9.0 | 0 | 9.0.8-r5 |
| Chainguard | cloudbeat-9.1 | 0 | 9.1.10-r0 |
| Chainguard | cloudbeat-9.2 | 0 | 9.2.2-r0 |
| Chainguard | cloudbeat-fips-8.17 | 0 | 8.17.10-r6 |
| Chainguard | cloudbeat-fips-8.18 | 0 | 8.18.8-r5 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.10-r0 |
| Chainguard | cloudbeat-fips-9.0 | 0 | 9.0.8-r5 |
| Chainguard | cloudbeat-fips-9.1 | 0 | 9.1.10-r0 |
| Chainguard | cloudbeat-fips-9.2 | 0 | 9.2.4-r0 |
| Chainguard | cosign | 0 | 3.0.4-r2 |
| Chainguard | cosign-fips | 0 | 3.0.4-r3 |
| Chainguard | crossplane-1.20 | 0 | 1.20.4-r3 |
| Chainguard | crossplane-2.0 | 0 | 2.0.6-r3 |
| Chainguard | crossplane-2.1 | 0 | 2.1.3-r4 |
| Chainguard | crossplane-fips-1.20 | 0 | 1.20.4-r4 |
| Chainguard | crossplane-fips-2.0 | 0 | 2.0.6-r3 |
| Chainguard | crossplane-fips-2.0 | 0 | 2.0.6-r4 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.3-r3 |
| Chainguard | crossplane-fips-2.1 | 0 | 2.1.3-r4 |
| Chainguard | dockerd-29 | 0 | 29.2.0-r1 |
| Chainguard | falcoctl | 0 | 0.12.2-r0 |
| Chainguard | falcoctl-fips | 0 | 0.12.2-r0 |
| Chainguard | flux-source-controller | 0 | 1.7.4-r6 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.4-r6 |
| Chainguard | gh | 0 | 2.86.0-r0 |
| Chainguard | gitsign | 0 | 0.14.0-r0 |
| Chainguard | gitsign-credential-cache | 0 | 0.13.0-r7 |
| Chainguard | goreleaser | 0 | 2.13.3-r3 |
| Chainguard | image-factory | 0 | 0.9.0-r5 |
| Chainguard | image-factory-fips | 0 | 1.0.2-r0 |
| Chainguard | ko | 0 | 0.18.1-r2 |
| Chainguard | ko-fips | 0 | 0.18.1-r2 |
| Chainguard | kubescape | 0 | 3.0.48-r0 |
| Chainguard | kyverno-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-background-controller-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-cleanup-controller-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cleanup-controller-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-cli-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-cli-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-init-container-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-init-container-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r35 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r34 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno | 0 | 0.5.3-r2 |
| Chainguard | kyverno-policy-reporter-plugins-kyverno-fips | 0 | 0.5.3-r3 |
| Chainguard | kyverno-reports-controller-1.12 | 0 | 1.12.7-r25 |
| Chainguard | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Chainguard | kyverno-reports-controller-fips-1.12 | 0 | 1.12.7-r28 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r3 |
| Chainguard | neuvector-sigstore-interface | 0 | 0_git20251212-r5 |
| Chainguard | neuvector-sigstore-interface-fips | 0 | 0_git20260130-r0 |
| Chainguard | policy-controller | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-fips | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester | 0 | 0.15.1-r0 |
| Chainguard | policy-controller-tester-fips | 0 | 0.15.1-r0 |
| Chainguard | ratify | 0 | 1.4.0-r9 |
| Chainguard | ratify-fips | 0 | 1.4.0-r9 |
| Chainguard | rekor-backfill-index | 0 | 1.5.0-r0 |
| Chainguard | rekor-cli | 0 | 1.5.0-r0 |
| Chainguard | rekor-fips-backfill-index | 0 | 1.5.0-r0 |
| Chainguard | rekor-fips-cli | 0 | 1.5.0-r0 |
| Chainguard | rekor-fips-server | 0 | 1.5.0-r0 |
| Chainguard | rekor-server | 0 | 1.5.0-r0 |
| Chainguard | reports-server | 0 | 0.1.6-r0 |
| Chainguard | sigstore-scaffolding-fips-tuf-server | 0 | 0.7.31-r6 |
| Chainguard | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r5 |
| Chainguard | skaffold | 0 | 2.17.1-r5 |
| Chainguard | skaffold-fips | 0 | 2.17.1-r2 |
| Chainguard | slsa-verifier | 0 | 2.7.1-r11 |
| Chainguard | spire-agent | 0 | 1.14.1-r1 |
| Chainguard | spire-agent-fips | 0 | 1.14.1-r3 |
| Chainguard | tekton-chains | 0 | 0.26.0-r4 |
| Chainguard | tekton-chains-fips | 0 | 0.26.0-r6 |
| Chainguard | teleport-15-kube-agent-updater | 0 | 15.5.4-r9 |
| Chainguard | teleport-16-kube-agent-updater | 0 | 16.5.18-r6 |
| Chainguard | teleport-18.6 | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Chainguard | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Chainguard | tflint | 0 | 0.60.0-r4 |
| Chainguard | tflint-fips | 0 | 0.60.0-r4 |
| Chainguard | tkn | 0 | 0.43.0-r5 |
| Chainguard | tkn-fips | 0 | 0.43.0-r4 |
| Chainguard | trivy | 0 | 0.69.0-r0 |
| Chainguard | trivy-fips | 0 | 0.69.0-r0 |
| Chainguard | trivy-operator | 0 | 0.29.0-r9 |
| Chainguard | trivy-operator-fips | 0 | 0.29.0-r9 |
| Chainguard | vexctl | 0 | 0.4.1-r7 |
| Chainguard | witness | 0 | 0.10.2-r2 |
| Chainguard | zarf | 0 | 0.70.1-r2 |
| Chainguard | zot | 0 | 2.1.14-r0 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | cosign | 0 | 3.0.5-150400.3.35.1 |
| Wolfi | aactl | 0 | 0.4.12-r39 |
| Wolfi | buildkitd | 0 | 0.27.0-r1 |
| Wolfi | cosign | 0 | 3.0.4-r2 |
| Wolfi | cosign-fips | 0 | 3.0.4-r3 |
| Wolfi | crossplane-2.1 | 0 | 2.1.3-r4 |
| Wolfi | dockerd-29 | 0 | 29.2.0-r1 |
| Wolfi | falcoctl | 0 | 0.12.2-r0 |
| Wolfi | flux-source-controller | 0 | 1.7.4-r6 |
| Wolfi | gh | 0 | 2.86.0-r0 |
| Wolfi | gitsign | 0 | 0.14.0-r0 |
| Wolfi | gitsign-credential-cache | 0 | 0.13.0-r7 |
| Wolfi | goreleaser | 0 | 2.13.3-r3 |
| Wolfi | ko | 0 | 0.18.1-r2 |
| Wolfi | ko-fips | 0 | 0.18.1-r2 |
| Wolfi | kubescape | 0 | 3.0.48-r0 |
| Wolfi | kyverno-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-background-controller-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-background-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cleanup-controller-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-cleanup-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-cli-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-cli-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-init-container-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-init-container-1.16 | 0 | 1.16.3-r2 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r35 |
| Wolfi | kyverno-reports-controller-1.12 | 0 | 1.12.7-r25 |
| Wolfi | kyverno-reports-controller-1.16 | 0 | 1.16.3-r2 |
| Wolfi | neuvector-sigstore-interface | 0 | 0_git20251212-r5 |
| Wolfi | policy-controller | 0 | 0.15.1-r0 |
| Wolfi | policy-controller-tester | 0 | 0.15.1-r0 |
| Wolfi | ratify | 0 | 1.4.0-r9 |
| Wolfi | rekor-backfill-index | 0 | 1.5.0-r0 |
| Wolfi | rekor-cli | 0 | 1.5.0-r0 |
| Wolfi | rekor-server | 0 | 1.5.0-r0 |
| Wolfi | sigstore-scaffolding-tuf-server | 0 | 0.7.31-r5 |
| Wolfi | skaffold | 0 | 2.17.1-r5 |
| Wolfi | slsa-verifier | 0 | 2.7.1-r11 |
| Wolfi | spire-agent | 0 | 1.14.1-r1 |
| Wolfi | tekton-chains | 0 | 0.26.0-r4 |
| Wolfi | teleport-18.6 | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-kube-agent-updater | 0 | 18.6.8-r9 |
| Wolfi | teleport-18.6-operator | 0 | 18.6.8-r9 |
| Wolfi | tflint | 0 | 0.60.0-r4 |
| Wolfi | tkn | 0 | 0.43.0-r5 |
| Wolfi | trivy | 0 | 0.69.0-r0 |
| Wolfi | trivy-operator | 0 | 0.29.0-r9 |
| Wolfi | vexctl | 0 | 0.4.1-r7 |
| Wolfi | witness | 0 | 0.10.2-r2 |
| Wolfi | zarf | 0 | 0.70.1-r2 |
| Wolfi | zot | 0 | 2.1.14-r0 |
| openSUSE:Leap 15.6 | cosign | 0 | 3.0.5-150400.3.35.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE:Leap 16.0 | cosign | 0 | 3.0.5-160000.1.1 |
| openSUSE:Tumbleweed | cosign | 0 | 3.0.5-1.1 |
Related vulnerabilities
- CVE-2026-24686 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2026-23991 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2024-47534 go-tuf is a Go implementation of The Update Framework (TUF). Also affects github.com/theupdateframework/go-tuf/v2
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl