AWS tough EUVD-2026-25628

Exploitation requires the TUF repository to be configured with delegated targets metadata (delegation feature enabled), not applicable to deployments using only top-level targets without delegation chains. Attacker must possess valid delegated signing keys, meaning either compromise of a legitimate delegated signer's credentials or malicious insider with officially granted delegation authority (PR:L in CVSS vector). The vulnerability is in the client-side load_delegations function, so exploitation occurs when a tough client synchronizes metadata from a repository containing the malicious delegated metadata. Attack complexity is high (AC:H) due to specialized conditions: attacker must understand TUF metadata structure, possess valid signing keys scoped to a delegation, and craft metadata that bypasses specific validation checks while maintaining valid signatures. Non-delegated TUF deployments or systems not using tough/tuftool as their TUF client are not vulnerable to this specific bypass.

Real-world risk assessment reveals moderate practical threat despite 7.1 CVSS score. The CVSS:4.0 vector shows Network vector (AV:N) but High complexity (AC:H) and specialized attack conditions (AT:P), requiring the attacker to already possess delegated signing authority (PR:L). This is NOT a remote unauthenticated attack-it requires pre-existing trust relationship and valid delegation keys. The Authentication Bypass tag is somewhat misleading; this bypasses metadata validation checks, not authentication itself. Impact is High for both Vulnerable and Subsequent system Integrity (VI:H, SI:H) with Low Availability impact (SA:L), meaning attackers can poison metadata caches and potentially serve malicious artifacts to clients trusting the TUF repository. No EPSS score provided, no KEV listing, no public POC identified-suggests discovery through internal security review rather than active exploitation. The AWS security bulletin indicates controlled disclosure and coordinated patching. Primary risk is to organizations using tough/tuftool in production TUF repositories with delegation chains, where a compromised or malicious delegated signer could exploit this to bypass integrity controls. Organizations without delegation (using only top-level targets metadata) are not affected by this specific code path. Patch availability from vendor significantly reduces ongoing risk for organizations able to upgrade.

An attacker who has obtained valid delegated signing keys (either through compromise of a legitimate delegated signer or as a malicious insider with delegated authority) crafts delegated targets metadata with manipulated fields: expired timestamps to serve stale packages, incorrect content hashes to enable substitution attacks, or invalid length fields to bypass size constraints. When a tough client processes this metadata via load_delegations, the missing validation allows the malicious metadata into the local cache. Subsequent package installations trust the poisoned cache, potentially downloading and executing malicious artifacts that would normally be rejected by TUF integrity checks. The attack complexity is high because it requires pre-existing delegation credentials and knowledge of TUF internals, but once achieved, the metadata poisoning can affect all clients syncing from the compromised repository.