{"id":"EUVD-2026-25628","enisaUuid":"09c9a8f8-516b-3f27-8274-b12130a3565e","description":"Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.\n\n\n\nWe recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.","datePublished":"Apr 24, 2026, 7:41:43 PM","dateUpdated":"Oct 20, 2026, 6:26:25 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L","references":"https://aws.amazon.com/security/security-bulletins/2026-019-aws/\nhttps://github.com/awslabs/tough/releases/tag/tough-v0.22.0\nhttps://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0\nhttps://crates.io/crates/tough/0.22.0\nhttps://crates.io/crates/tuftool/0.15.0\nhttps://github.com/awslabs/tough/security/advisories/GHSA-4v58-8p28-2rq3\n","aliases":"CVE-2026-6967\n","assigner":"AMZN","epss":0.25,"enisaIdProduct":[{"id":"81c610e2-cd39-3015-9d82-d33ac71e28b0","product":{"name":"tuftool","vendor":{"name":"aws"}},"product_version":"0 ≤0.14"},{"id":"e0097652-8719-38b9-84e5-06da022158a8","product":{"name":"tough","vendor":{"name":"aws"}},"product_version":"0.9.0 ≤0.21"}],"enisaIdVendor":[{"id":"ad9ba1e1-d5a4-3633-bd23-e51e38989a71","vendor":{"name":"aws"}}],"enisaIdVulnerability":[{"id":"7ee22515-33ad-3011-8e19-1a871ba5f950","vulnerability":{"id":"GHSA-4v58-8p28-2rq3","description":"awslabs/tough is Missing Delegated Metadata Validation","datePublished":"May 5, 2026, 6:46:48 PM","dateUpdated":"May 5, 2026, 6:46:48 PM","baseScore":0.0,"references":"https://github.com/awslabs/tough/security/advisories/GHSA-4v58-8p28-2rq3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6967\nhttps://aws.amazon.com/security/security-bulletins/2026-019-aws\nhttps://crates.io/crates/tough/0.22.0\nhttps://crates.io/crates/tuftool/0.15.0\nhttps://github.com/awslabs/tough\nhttps://github.com/awslabs/tough/releases/tag/tough-v0.22.0\nhttps://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0\n","enisa_id":"EUVD-2026-25628\n","aliases":"GHSA-4v58-8p28-2rq3\nCVE-2026-6967\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"baa1e880-b331-3fc0-99f2-83fa2ecefa87","vulnerability":{"id":"CVE-2026-6967","description":"Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.\n\n\n\nWe recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.","datePublished":"Apr 24, 2026, 7:41:43 PM","dateUpdated":"Oct 20, 2026, 6:26:25 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:L","references":"https://aws.amazon.com/security/security-bulletins/2026-019-aws/\nhttps://github.com/awslabs/tough/releases/tag/tough-v0.22.0\nhttps://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0\nhttps://crates.io/crates/tough/0.22.0\nhttps://crates.io/crates/tuftool/0.15.0\nhttps://github.com/awslabs/tough/security/advisories/GHSA-4v58-8p28-2rq3\n","enisa_id":"EUVD-2026-25628\n","assigner":"AMZN","epss":0.25,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"5ea4dc98-496a-30c2-8cf8-28670a0a8160","product":{"name":"tough","vendor":{"name":"aws"}},"product_version":"0.9.0 ≤0.21"},{"id":"908e241a-507b-3008-b822-328e55892f50","product":{"name":"tuftool","vendor":{"name":"aws"}},"product_version":"0 ≤0.14"}],"vulnerabilityVendor":[{"id":"01df1038-5582-340b-a53e-8e0615629ddd","vendor":{"name":"aws"}}]}}],"enisaIdAdvisory":[]}