CVE-2026-6967: Missing Delegated Metadata Validation in awslabs/tough
Summary Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because loaddelegations does not apply the same validation checks as the top-level targets metadata path.
Impact The tough library, prior to 0.22.0, does not properly verify delegated target metadata. It allows someone with write access to the metadata to serve expired or otherwise invalid targets from a TUF repository which tough will then trust rather than reject.
Impacted Versions: tough 0.9.0 through 0.21.x, tuftool through 0.14.x
Patches This issue has been addressed in tough version 0.22.0 and tuftool version 0.15.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds No workarounds to this issue are known.
References CVE-2026-6967 If there are any questions or comments about this advisory, please contact [AWS/Amazon] Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
Amazon Web Services Labs would like to thank Oleh Konko of 1seal for collaborating on this issue through the coordinated vulnerability disclosure process.
Other sources
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because loaddelegations does not apply the same validation checks as the top-level targets metadata path.
We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/tuftoolto a version that resolves this vulnerability.Fixed in 0.15.0 - Upgrade
Upgrade
rust/toughto a version that resolves this vulnerability.Fixed in 0.22.0 - Upgrade
Upgrade
awslabs/toughto a version that resolves this vulnerability.Fixed in 0.22.0 - Upgrade
Upgrade
awslabs/tuftoolto a version that resolves this vulnerability.Fixed in 0.15.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6967?
CVE-2026-6967 is classified as a high-severity vulnerability due to its potential impact on the integrity of delegated signing authority.
How do I fix CVE-2026-6967?
To fix CVE-2026-6967, upgrade to tough version 0.22.0 or later and tuftool version 0.15.0 or later.
Who is affected by CVE-2026-6967?
CVE-2026-6967 affects users of awslabs/tough versions before 0.22.0 and awslabs/tuftool versions before 0.15.0.
What is the impact of CVE-2026-6967?
The impact of CVE-2026-6967 is that it allows remote authenticated users to bypass critical integrity checks, potentially compromising system security.
What does delegated metadata validation mean in the context of CVE-2026-6967?
Delegated metadata validation refers to the process of verifying metadata integrity in delegated signing scenarios, which is improperly handled in CVE-2026-6967.