GHSA-8m7c-8m39-rv4x CVE-2026-6966
awslabs/tough Delegated Roles have a Signature Threshold Bypass
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.28%
- Chance of exploitation in the next 30 days. Higher than 20.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-347 Improper Verification of Cryptographic Signature
- Fix
- Available
- 2 packages have a fixed version
Description
Summary
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.
Impact
The tough library, prior to 0.22.0, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures in delegated targets. It allows actors with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a minimum threshold of unique keys before the metadata is considered valid.
Patches
This issue has been addressed in tough version 0.22.0 and tuftool version 0.15.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
No workarounds to this issue are known.
References
- CVE-2026-6966
If there are any questions or comments about this advisory, please contact [AWS/Amazon] Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
Amazon Web Services Labs would like to thank Emily Albini of Oxide Computer and Oleh Konko of 1seal for collaborating on this issue through the coordinated vulnerability disclosure process
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
tough crates.io → 0.22.0
- cargo
cargo update -p tough --precise 0.22.0
tuftool crates.io → 0.15.0
- cargo
cargo update -p tuftool --precise 0.15.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- High
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-4v58-8p28-2rq3 awslabs/tough is Missing Delegated Metadata Validation | Medium | Also affects tough |
| GHSA-j8x2-777p-23fc tough cyclic delegation graphs are not detected | Low | Also affects tough |
| GHSA-76g3-38jv-wxh4 tough timestamp metadata is cached when it fails snapshot rollback check | Medium | Also affects tough |
| GHSA-q6r9-r9pw-4cf7 tough failure to detect delegated target rollback | Medium | Also affects tough |
| GHSA-v4wr-j3w6-mxqc tough terminating targets role delegations are not respected | Medium | Also affects tough |
| GHSA-5vmp-m5v2-hx47 tough root metadata version is not checked for sequential versioning | Medium | Also affects tough |
| GHSA-r56q-vv3c-6g9c Improper sanitization of delegated role names | High | Also affects tough |
| GHSA-x3r5-q6mj-m485 Improper sanitization of target names | High | Also affects tough |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor