CVE-2026-6967: tough from 0.9.0 (inclusive), before 0.22.0 (exclusive), 0.9.0 through 0.21; +1 more affected products

Affected technology

tough · from 0.9.0 (inclusive), before 0.22.0 (exclusive)
amazon

tuftool · before 0.15.0 (exclusive)
amazon

tough · 0.9.0 through 0.21
AWS

tuftool · 0 through 0.14
AWS

Description’s affected range: before tough-v0.22.0

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Remote authenticated users with delegated signing authority can bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and availability impact as none; integrity impact as high.