Executive brief
tough terminating targets role delegations are not respected
Affected products
- crates.io tough
Junglewise Threat Intelligence
CVE-2025-2886: tough terminating targets role delegations are not respected
CVE-2025-2886 · Severity: low · CVSS 3.1 · Published 2025-03-28
Technologies: tough (crates.io). Vendors: crates.io.
Related threats
- awslabs/tough is Missing Delegated Metadata Validation
- awslabs/tough Delegated Roles have a Signature Threshold Bypass
- tough cyclic delegation graphs are not detected
- tough root metadata version is not checked for sequential versioning
- tough timestamp metadata is cached when it fails snapshot rollback check