# GHSA-qp9x-wp8f-qgjj: tuf has platform-dependent delegation path matching

> Attackers can bypass TUF delegation path restrictions on Windows clients due to case-insensitive matching, allowing unauthorized target updates.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 28 May 2026

## What is GHSA-qp9x-wp8f-qgjj?

GHSA-qp9x-wp8f-qgjj is a vulnerability in tuf, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

`DelegatedRole._is_target_in_pathpattern` uses `fnmatch.fnmatch` to decide whether a given target path is authorized by a delegation's glob pattern.

Python's `fnmatch.fnmatch` calls `os.path.normcase()` on both arguments before matching. On POSIX hosts `normcase` is the identity function; on Windows hosts `os.path` resolves to `ntpath`, whose `normcase` lowercases its input and replaces `/` with `\`.

As a result, python-tuf's delegation *path pattern* matching is case-sensitive on Linux/macOS but case-INSENSITIVE on Windows. This makes the authorization decision for a target dependent on the host operating system of the client running the updater.

The result on Windows is a TUF specification violation in the python-tuf `ngclient` implementation.

## Vulnerable code

`tuf/api/_payload.py` (HEAD `7ecb67d`):

```python
1183  @staticmethod
1184  def _is_target_in_pathpattern(targetpath: str, pathpattern: str) -> bool:
1185      """Determine whether ``targetpath`` matches the ``pathpattern``."""
1186      # We need to make sure that targetpath and pathpattern are pointing to
1187      # the same directory as fnmatch doesn't threat "/" as a special symbol.
1188      target_parts = targetpath.split("/")
1189      pattern_parts = pathpattern.split("/")
1190      if len(target_parts) != len(pattern_parts):
1191          return False
1192
1193      # Every part in the pathpattern could include a glob pattern, that's why
1194      # each of the target and pathpattern parts should match.
1195      for target, pattern in zip(target_parts, pattern_parts, strict=True):
1196          if not fnmatch.fnmatch(target, pattern):
1197              return False
1198      return True
```

`fnmatch.fnmatch` source (Python 3.12, unchanged in current mainline):

```python
def fnmatch(name, pat):
    ...
    name = os.path.normcase(name)
    pat = os.path.normcase(pat)
    return fnmatchcase(name, pat)
```

## Fix

Replace `fnmatch.fnmatch` with `fnmatch.fnmatchcase`, which is explicitly documented as "not applying case normalization", so it behaves identically across platforms.

## Attack

1. A TUF repository with two path-based delegations whose patterns differ only in case — for example, `Foo/*` and `foo/*`.
2. The "attacker" delegation is listed BEFORE the "legit" delegation in the delegation order.
3. The client searches for `foo/something`: on Windows, it will find the "attacker" provided target "Foo/something".

## Exploitability caveats 

* The attack needs a repository configuration with case-colliding delegation path patterns. The attacker must control one of the delegated roles.
* Delegation ordering matters: the attacker-controlled role must be visited BEFORE the legit role in the pre-order walk.
* The client must run on Windows. No effect on Linux/macOS.

## Credit

Reporter: Koda Reef @kodareef5 
Advisory edits: Jussi Kukkonen @jku

## Which versions are affected by GHSA-qp9x-wp8f-qgjj?

2 open source packages ship an affected version, including tuf.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `tuf` | PyPI | All versions | 7.0.0 |
| `tuf` | PyPI | All versions | 7.0.0 |

## How do I fix GHSA-qp9x-wp8f-qgjj?

Upgrade tuf to 7.0.0 or later.

## Is GHSA-qp9x-wp8f-qgjj being exploited?

There is no known exploitation of GHSA-qp9x-wp8f-qgjj in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-qp9x-wp8f-qgjj and fix it if it is affected.

What it is: GHSA-qp9x-wp8f-qgjj is a vulnerability in tuf, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-qp9x-wp8f-qgjj in the wild and no public exploit code.

Affected packages and fixed versions:
- tuf (PyPI): affected all versions; fixed in 7.0.0
- tuf (PyPI): affected all versions; fixed in 7.0.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-qp9x-wp8f-qgjj/ (Markdown: https://insights.sbomify.com/GHSA-qp9x-wp8f-qgjj/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-qp9x-wp8f-qgjj

---
From sbomify Insights: https://insights.sbomify.com/GHSA-qp9x-wp8f-qgjj/
Summaries are generated and may contain mistakes; the official description above is the record.