CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles

What is CVE-2026-6966?

CVE-2026-6966 is a high-severity vulnerability in AWS tough, published on 24 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.

We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Weakness: CWE-347

Which versions are affected by CVE-2026-6966?

4 open source packages ship an affected version, including tough and tuftool. It affects 2 products.

Products include Amazon Tough, Amazon Tuftool.

How do I fix CVE-2026-6966?

Upgrade tough to 0.22.0 or later.

Is CVE-2026-6966 being exploited?

There is no known exploitation of CVE-2026-6966 in the wild and no public exploit code.

Other vulnerabilities in AWS tough

• CVE-2020-15093 Improper verification of signature threshold in tough High 8.6
• CVE-2021-41149 Improper sanitization of target names in tough High 8.2
• CVE-2021-41150 Improper sanitization of delegated role names in tough High 8.2
• CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough High 7.1
• CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8m7c-8m39-rv4x.