CVE-2025-2887 Failure to detect delegated target rollback in tough
Attackers can alter target contents by exploiting a failure to detect delegated target rollbacks in the tough library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-2887?
CVE-2025-2887 is a medium-severity vulnerability in AWS tough, published on 27 Mar 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
Weakness: CWE-1025
Which versions are affected by CVE-2025-2887?
2 open source packages ship an affected version, including tough. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tough crates.io | All versions | 0.20.0 |
tough crates.io | All versions | 0.20.0 |
Products include Amazon Tough.
How do I fix CVE-2025-2887?
Upgrade tough to 0.20.0 or later.
Is CVE-2025-2887 being exploited?
There is no known exploitation of CVE-2025-2887 in the wild and no public exploit code.
Other vulnerabilities in AWS tough
- CVE-2020-15093 Improper verification of signature threshold in tough
- CVE-2021-41149 Improper sanitization of target names in tough
- CVE-2021-41150 Improper sanitization of delegated role names in tough
- CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough
- CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough
Sources
Also known as GHSA-q6r9-r9pw-4cf7.