CVE-2026-6968
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.
Risk Assessment
An attacker with delegated signing authority could write files to unexpected locations, potentially overwriting critical files or leading to privilege escalation. However, authentication and delegated permissions are required.
Recommendation
Upgrade the tough library to version tough-v0.22.0 or later and tuftool to version tuftool-v0.15.0 or later.
Other vulnerabilities in awslabs/tough
See all- CVE-2026-6967Medium
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.
- CVE-2026-6966Medium
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.
Original NVD description (English source)
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS