Vulnerability · Published Apr 24, 2026 · Assigned by AMZN

CVE-2026-6967Missing Delegated Metadata Validation in awslabs/tough

Medium 5.9

In plain English

A medium-severity insufficient verification of data authenticity in tough from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Affected products (as reported)

Vendor	Product	Versions
AWS	tough	0.9.0 – through 0.21
AWS	tuftool	0 – through 0.14

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://aws.amazon.com/security/security-bulletins/2026-019-aws/ vendor-advisory
https://github.com/awslabs/tough/releases/tag/tough-v0.22.0 patch
https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0 patch
https://crates.io/crates/tough/0.22.0 patch
https://crates.io/crates/tuftool/0.15.0 patch
https://github.com/awslabs/tough/security/advisories/GHSA-4v58-8p28-2rq3 third-party-advisory