{"id":"EUVD-2026-25627","enisaUuid":"4705d6c0-9f74-318f-a566-2955f0c69ecf","description":"Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.\n\n\n\nWe recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.","datePublished":"Apr 24, 2026, 7:38:24 PM","dateUpdated":"Oct 20, 2026, 6:24:24 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://aws.amazon.com/security/security-bulletins/2026-019-aws/\nhttps://github.com/awslabs/tough/releases/tag/tough-v0.22.0\nhttps://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0\nhttps://crates.io/crates/tough/0.22.0\nhttps://crates.io/crates/tuftool/0.15.0\nhttps://github.com/awslabs/tough/security/advisories/GHSA-8m7c-8m39-rv4x\n","aliases":"CVE-2026-6966\n","assigner":"AMZN","epss":0.28,"enisaIdProduct":[{"id":"47de382e-ec91-38bc-9ec8-c5e489b44430","product":{"name":"tough","vendor":{"name":"aws"}},"product_version":"0.9.0 ≤0.21"},{"id":"b99d62cc-f9e9-3446-91f5-8203a6bb97f7","product":{"name":"tuftool","vendor":{"name":"aws"}},"product_version":"0 ≤0.14"}],"enisaIdVendor":[{"id":"57b7bd9f-774c-382e-8204-9eeca12a1d33","vendor":{"name":"aws"}}],"enisaIdVulnerability":[{"id":"223fbb02-379b-3f35-ab59-38741543e6fe","vulnerability":{"id":"CVE-2026-6966","description":"Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.\n\n\n\nWe recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.","datePublished":"Apr 24, 2026, 7:38:24 PM","dateUpdated":"Oct 20, 2026, 6:24:24 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://aws.amazon.com/security/security-bulletins/2026-019-aws/\nhttps://github.com/awslabs/tough/releases/tag/tough-v0.22.0\nhttps://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0\nhttps://crates.io/crates/tough/0.22.0\nhttps://crates.io/crates/tuftool/0.15.0\nhttps://github.com/awslabs/tough/security/advisories/GHSA-8m7c-8m39-rv4x\n","enisa_id":"EUVD-2026-25627\n","assigner":"AMZN","epss":0.28,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"6841668d-08b9-3ba9-a04e-f3071a90b9f1","product":{"name":"tough","vendor":{"name":"aws"}},"product_version":"0.9.0 ≤0.21"},{"id":"76fe7edf-c156-37ca-afe3-a13554efeb3e","product":{"name":"tuftool","vendor":{"name":"aws"}},"product_version":"0 ≤0.14"}],"vulnerabilityVendor":[{"id":"8a9d3b6b-93da-3a81-aacb-3904f5df17fe","vendor":{"name":"aws"}}]}},{"id":"b2283f76-fd0f-3a36-9352-7b2beb669d8d","vulnerability":{"id":"GHSA-8m7c-8m39-rv4x","description":"awslabs/tough Delegated Roles have a Signature Threshold Bypass","datePublished":"May 5, 2026, 6:46:09 PM","dateUpdated":"May 5, 2026, 6:46:09 PM","baseScore":0.0,"references":"https://github.com/awslabs/tough/security/advisories/GHSA-8m7c-8m39-rv4x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6966\nhttps://aws.amazon.com/security/security-bulletins/2026-019-aws\nhttps://crates.io/crates/tough/0.22.0\nhttps://crates.io/crates/tuftool/0.15.0\nhttps://github.com/awslabs/tough\nhttps://github.com/awslabs/tough/releases/tag/tough-v0.22.0\nhttps://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0\n","enisa_id":"EUVD-2026-25627\n","aliases":"CVE-2026-6966\nGHSA-8m7c-8m39-rv4x\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}