CVE-2025-2886 Terminating targets role delegations are not respected in tough

What is CVE-2025-2886?

CVE-2025-2886 is a medium-severity vulnerability in AWS tough, published on 27 Mar 2025.

Official description

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Weakness: CWE-670

Which versions are affected by CVE-2025-2886?

2 open source packages ship an affected version, including tough. It affects 1 product.

Products include Amazon Tough.

How do I fix CVE-2025-2886?

Upgrade tough to 0.20.0 or later.

Is CVE-2025-2886 being exploited?

There is no known exploitation of CVE-2025-2886 in the wild and no public exploit code.

Other vulnerabilities in AWS tough

• CVE-2020-15093 Improper verification of signature threshold in tough High 8.6
• CVE-2021-41149 Improper sanitization of target names in tough High 8.2
• CVE-2021-41150 Improper sanitization of delegated role names in tough High 8.2
• CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough High 7.1
• CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v4wr-j3w6-mxqc.