CVE-2026-6967: awslabs/tough is Missing Delegated Metadata Validation

CVE-2026-6967 · Severity: medium · CVSS 5.9 · Published 2026-04-24

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.

We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Technologies: Amazon Tough, Amazon Tuftool, tough (crates.io). Vendors: Amazon, crates.io.

Quick answers

Is CVE-2026-6967 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6967 being exploited in the wild.
How severe is CVE-2026-6967?
Medium severity, with a CVSS score of 5.9, published 24 April 2026.
Which products and versions are affected?
tough (crates.io) SEMVER:introduced=0.9.0,fixed=0.22.0; tuftool (crates.io) SEMVER:introduced=0,fixed=0.15.0.
Is there a fix for CVE-2026-6967?
Yes. tough (crates.io): upgrade to 0.22.0 or later; tuftool (crates.io): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-6967?
Check whether you run Amazon Tough, Amazon Tuftool, tough (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tough (crates.io): upgrade to 0.22.0 or later
    cargo update -p tough
  • tuftool (crates.io): upgrade to 0.15.0 or later
    cargo update -p tuftool

Affected products

  • Amazon Tough
  • Amazon Tuftool
  • tough (crates.io) SEMVER:introduced=0.9.0,fixed=0.22.0
  • tuftool (crates.io) SEMVER:introduced=0,fixed=0.15.0

Identifiers

  • CVE-2026-6967
  • GHSA-4v58-8p28-2rq3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.