CVE-2026-6967 Missing Delegated Metadata Validation in awslabs/tough

What is CVE-2026-6967?

CVE-2026-6967 is a high-severity missing authorization vulnerability in AWS tough, published on 24 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.

We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Weakness: CWE-345

Which versions are affected by CVE-2026-6967?

4 open source packages ship an affected version, including tough and tuftool. It affects 2 products.

Products include Amazon Tough, Amazon Tuftool.

How do I fix CVE-2026-6967?

Upgrade tough to 0.22.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-6967 being exploited?

There is no known exploitation of CVE-2026-6967 in the wild and no public exploit code.

Other vulnerabilities in AWS tough

• CVE-2020-15093 Improper verification of signature threshold in tough High 8.6
• CVE-2021-41149 Improper sanitization of target names in tough High 8.2
• CVE-2021-41150 Improper sanitization of delegated role names in tough High 8.2
• CVE-2026-6968 Multiple Path Traversal Variants in awslabs/tough High 7.1
• CVE-2026-6966 Signature Threshold Bypass in awslabs/tough Delegated Roles High 7.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4v58-8p28-2rq3.