Threat Intelligence Database

CVE-2026-24686 is a path traversal vulnerability in go-tuf versions 2.0.0 up to but not including 2.4.1. The flaw arises because the map file repository name string (`repoName`) is used directly as a filesystem path component without proper sanitization. An attacker supplying a malicious `repoName` containing traversal sequences (e.g. , '.. /') can cause go-tuf to write metadata files outside the intended cache directory, potentially overwriting or creating files with the permissions of the running process.

MediumVulnerabilityGermanyFranceNetherlands+6#cve#cve-2026-24686#cwe-22

CVE-2026-23992 is a medium severity vulnerability in go-tuf, a Go implementation of The Update Framework (TUF). Versions from 2.0.0 up to but not including 2.3.1 allow the signature threshold to be set to 0, effectively disabling cryptographic signature verification. This misconfiguration or compromise of a TUF repository can permit unauthorized modification of metadata files without detection, undermining integrity during storage or transit. No confidentiality or availability impact is directly noted, but integrity is severely affected. The vulnerability requires no authentication or user interaction but has a high attack complexity due to needing repository compromise or misconfiguration. The issue is fixed in version 2.

MediumVulnerabilityGermanyFranceNetherlands+7#cve#cve-2026-23992#cwe-347

CVE-2026-23991 is a medium severity vulnerability in go-tuf, a Go implementation of The Update Framework (TUF). Versions from 2.0.0 up to but not including 2.3.1 are affected. The vulnerability arises when the TUF repository or its mirrors return invalid but syntactically correct JSON metadata that is not well-formed according to TUF specifications. This causes the client to panic during parsing before signature validation, resulting in a denial of service (DoS). An attacker controlling a repository, mirror, or cache can exploit this without needing signing keys. No user interaction or authentication is required, and no known workarounds exist.

MediumVulnerabilityGermanyFranceNetherlands+2#cve#cve-2026-23991#cwe-617