CVE-2026-23992 go-tuf improperly validates the configured threshold for delegations

What is CVE-2026-23992?

CVE-2026-23992 is a medium-severity vulnerability in theupdateframework go-tuf, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

Weakness: CWE-347

Which versions are affected by CVE-2026-23992?

3 open source packages ship an affected version, including github.com/theupdateframework/go-tuf/v2. It affects 1 product.

Products include Theupdateframework Go-Tuf.

How do I fix CVE-2026-23992?

Upgrade github.com/theupdateframework/go-tuf/v2 to 2.3.1 or later.

Is CVE-2026-23992 being exploited?

There is no known exploitation of CVE-2026-23992 in the wild and no public exploit code.

Other vulnerabilities in theupdateframework go-tuf

• CVE-2022-29173 No protection against rollback attacks in go-tuf High 8.0
• CVE-2026-23991 go-tuf affected by client DoS via malformed server response Medium 5.9
• CVE-2026-24686 go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-75189, BELL-CVE-2026-23992, CLEANSTART-2026-PA71152, CLEANSTART-2026-UW62677, DEBIAN-CVE-2026-23992, GHSA-fphv-w9fq-2525 and 35 more.