Threat Intelligence Database

Bulletin ID: 2026-019-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/04/24 13:30 AM PDT Description: Multiple security issues have been identified in the tough library and tuftool CLI utility. tough is a Rust library used for generating, signing, and managing TUF (The Update Framework) repositories, and tuftool is the command-line interface for repository management Operations. The following issues have been identified: - CVE-2026-6966 - CVE-2026-6967 - CVE-2026-6968 Impacted versions: - tough: versions 0.1.0 through 0.21.x (inclusive) - tuftool: versions 0.1.0 through 0.14.x (inclusive) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CVE-2026-6968 is a path traversal vulnerability in AWS's tough project before version 0.22.0. It allows remote authenticated users with delegated signing authority to write files outside intended directories by exploiting incomplete path traversal fixes. The issue arises because write paths trust the joined destination path without verifying containment after resolving symlinks or absolute paths. AWS recommends upgrading to tough-v0.22.0 or tuftool-v0.15.0 to address this vulnerability.

CVE-2026-6967 is a vulnerability in AWS tough before version 0.22.0 where delegated metadata validation lacks expiration, hash, and length enforcement. This allows remote authenticated users with delegated signing authority to bypass integrity checks on delegated targets metadata, potentially poisoning the local metadata cache. The issue arises because the load_delegations function does not enforce the same validation as the top-level targets metadata path. AWS recommends upgrading to tough-v0.22.0 or tuftool-v0.15.0 to address this issue.