CVE-2026-123806 python-tuf: Platform-dependent delegation path matching
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123806?
CVE-2026-123806 is a medium-severity vulnerability in theupdateframework python-tuf, published on 9 Nov 2026.
Official description
python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0.
Weakness: CWE-178
Which versions are affected by CVE-2026-123806?
1 open source package ship an affected version, including tuf.
| Package | Affected | Fixed in |
|---|---|---|
tuf PyPI | All versions | 7.0.0 |
How do I fix CVE-2026-123806?
Upgrade tuf to 7.0.0 or later.
Is CVE-2026-123806 being exploited?
There is no known exploitation of CVE-2026-123806 in the wild and no public exploit code.
Sources
Also known as GHSA-qp9x-wp8f-qgjj, MINI-2mqm-q893-2pgh, MINI-4jcc-f3mx-66p2, MINI-v7f4-x42m-v3qc, UBUNTU-CVE-2026-123806.