CVE-2026-23992
MediumCVSS 5.9Summary
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification of TUF metadata files at rest or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always ensure that TUF metadata roles are configured with a threshold of at least 1.
Risk Assessment
An attacker could modify TUF metadata without detection, potentially leading to the delivery of malicious updates or compromise of the software supply chain integrity. Organizations using go-tuf are exposed to significant security risk.
Recommendation
Update go-tuf to version 2.3.1 or later. Additionally, configure signature thresholds for all TUF roles to at least 1 and regularly verify the repository configuration.
Other vulnerabilities in go-tuf
See all- CVE-2026-24686Medium
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended LocalMetadataDir cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
- CVE-2026-23991Medium
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to 2.3.1, if the TUF repository (or any mirror) returns invalid TUF metadata JSON (valid JSON but not well-formed TUF metadata), the client panics during parsing, causing denial of service. The panic occurs before signature validation, so a compromised repository/mirror/cache can DoS clients without any signing key.
Original NVD description (English source)
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS