Executive brief
awslabs/tough is Missing Delegated Metadata Validation
Affected products
- crates.io tough
- crates.io tuftool
Junglewise Threat Intelligence
CVE-2026-6967: awslabs/tough is Missing Delegated Metadata Validation
CVE-2026-6967 · Severity: low · CVSS 3.1 · Published 2026-05-05
Technologies: tough (crates.io). Vendors: crates.io.
Related threats
- awslabs/tough Delegated Roles have a Signature Threshold Bypass
- tough cyclic delegation graphs are not detected
- tough terminating targets role delegations are not respected
- tough root metadata version is not checked for sequential versioning
- tough timestamp metadata is cached when it fails snapshot rollback check