Ghostwire

CVE-2026-6967: Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0...

MEDIUM CVSS 5.9 1 PoC

Published: April 24, 2026 | Last Modified: April 24, 2026

Description

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Ghostwire Analysis — What This Means Practically

Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
1 proof-of-concept exploit available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (1)

awslabs/tough

CVE-2026-6967: Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0...

Description

Ghostwire Analysis — What This Means Practically

Proof-of-Concept Exploits (1)

Security Coverage (1 articles)

References