Threats affecting pkg:cargo/awslabs/tough

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

CVE-2026-6966 is a medium severity vulnerability in AWS tough prior to version 0.22.0. It involves improper verification of cryptographic signature uniqueness during delegated role validation, allowing remote authenticated users to bypass the TUF signature threshold by duplicating a valid signature. This causes the client to accept forged delegated role metadata. AWS has released tough-v0.22.0 and tuftool-v0.15.0 to address this issue.