PT-2026-35080 · Pypi · Tough

1Seal · Published 2026-04-24 · Updated 2026-05-21 · CVE-2026-6967

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions tough versions prior to 0.22.0

Description Remote authenticated users with delegated signing authority can bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache. This occurs because the load delegations() function does not apply the same validation checks regarding expiration, hash, and length enforcement as the top-level targets metadata path.

Recommendations Upgrade to version 0.22.0.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-6967

GHSA-4V58-8P28-2RQ3

Affected Products

Tough

References · 13

• https://github.com/awslabs/tough/releases/tag/tough-v0.22.0 · Patch
• https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0 · Patch
• https://github.com/awslabs/tough/security/advisories/GHSA-4v58-8p28-2rq3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4v58-8p28-2rq3 · Vendor Advisory
• https://crates.io/crates/tough/0.22.0 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-019-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6967 · Security Note
• https://crates.io/crates/tuftool/0.15.0 · Patch
• https://github.com/awslabs/tough · Note
• https://twitter.com/lyrie_ai/status/2057378683342430528 · Twitter Post
• https://twitter.com/lyrie_ai/status/2057378681459286022 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047838858876723405 · Twitter Post
• https://twitter.com/CVEnew/status/2047798558989201740 · Twitter Post