Which versions of AWS Tough are affected by CVE-2026-6966?

AWS Tough TUF client versions prior to 0.22.0 contain a signature validation flaw that allows authenticated attackers to bypass multi-signature protections on delegated role metadata, potentially…. A patch is available.

How to fix or mitigate CVE-2026-6966?

Within 24 hours: Inventory all systems and applications using AWS Tough TUF client and identify current versions in use. Within 7 days: Upgrade Tough TUF client to v0.22.0 or later and tuftool to v0.15.0 or later across all environments; test metadata validation workflows post-upgrade. Within 30 days: Audit authentication credentials and access controls for systems with write permissions to delegated role metadata; implement monitoring for anomalous signature reuse patterns in metadata logs.

AWS Tough CVE-2026-6966

Q: What is the CVSS score of CVE-2026-6966?

CVE-2026-6966 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25627 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-24 AMZN

GHSA-8m7c-8m39-rv4x

Jwt Attack Authentication Bypass

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 21:22 vuln.today

cvss_changed

Analysis Generated

Apr 24, 2026 - 20:32 vuln.today

Severity Changed

Apr 24, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Apr 24, 2026 - 20:22 NVD

5.3 (MEDIUM) 7.0 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 20:15 euvd

EUVD-2026-25627

Analysis Generated

Apr 24, 2026 - 20:15 vuln.today

Patch released

Apr 24, 2026 - 20:15 nvd

Patch available

CVE Published

Apr 24, 2026 - 19:38 nvd

HIGH 7.0

DescriptionCVE.org

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.

We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

AnalysisAI

Signature duplication in AWS Tough TUF client prior to v0.22.0 allows authenticated attackers to bypass threshold signature requirements for delegated role metadata by reusing a single valid signature multiple times. The flaw undermines TUF's multi-signature integrity model, enabling acceptance of forged metadata with reduced cryptographic validation. Vendor patch available (tough-v0.22.0, tuftool-v0.15.0). No public exploit code or active exploitation confirmed at time of analysis, but CVSS 7.0 reflects high integrity impact to both vulnerable and downstream systems.

Technical ContextAI

AWS Tough implements The Update Framework (TUF), a security framework for software update systems requiring threshold signatures (N-of-M valid signatures) on repository metadata to prevent tampering. TUF delegated roles allow repository owners to distribute signing authority across multiple keys. CWE-347 (Improper Verification of Cryptographic Signature) manifests here as a signature uniqueness validation failure - the client counts duplicate copies of the same signature toward the threshold requirement rather than enforcing N distinct valid signatures. For example, a 3-of-5 threshold could be satisfied with one valid signature duplicated three times instead of three independent signatures. This affects cpe:2.3:a:aws:tough:*:*:*:*:*:*:*:* (versions prior to 0.22.0) and cpe:2.3:a:aws:tuftool:*:*:*:*:*:*:*:* (versions prior to 0.15.0), the Rust-based TUF client library and tooling published to crates.io and maintained by AWS Labs.

RemediationAI

Upgrade to tough-v0.22.0 or tuftool-v0.15.0 immediately. For Rust projects using Cargo, update Cargo.toml dependencies to tough = "0.22.0" or tuftool = "0.15.0" and run cargo update. Patched releases available at https://github.com/awslabs/tough/releases/tag/tough-v0.22.0, https://github.com/awslabs/tough/releases/tag/tuftool-v0.15.0, and published to crates.io (https://crates.io/crates/tough/0.22.0, https://crates.io/crates/tuftool/0.15.0). No workarounds exist - the vulnerability is in core signature validation logic. If immediate upgrade is not feasible, implement compensating controls by restricting network access to TUF repository clients to trusted networks only, enforcing strict key management for all delegated role signing keys (treat compromise of any single key as critical incident), and implementing out-of-band verification of critical metadata updates until patching is complete. Note that restricting access reduces attack surface but does not eliminate risk from authenticated insiders or compromised credentials. Review recent metadata updates accepted by vulnerable client versions for anomalies such as unexpected role delegations or package additions.