CVE-2026-6967
Medium · 5.9CVSS
5.9
EPSS
0.3%
Published
Apr 24, 2026
CISA due date
—
The record
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | tough | 0.9.0 | 0.22.0 |
| crates.io | tuftool | 0 | 0.15.0 |
Related vulnerabilities
- GHSA-4v58-8p28-2rq3 awslabs/tough is Missing Delegated Metadata Validation Same vulnerability
- GHSA-8m7c-8m39-rv4x awslabs/tough Delegated Roles have a Signature Threshold Bypass Also affects tough
- CVE-2026-6966 Improper verification of cryptographic signature uniqueness in delegated role validation… Also affects tough
- CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and multimodal… CWE-345
- CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-345
- CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no… CWE-345