Vulnetix
Try Vulnetix Request Demo
CVE-2026-23992 PUBLISHED CVSS 5.900000095367432 MEDIUM

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

EPSS 0.01% · 1.0th percentile

Risk Scores

CVSS v3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
0.01%
1.0th percentile

Affected Products

VendorProductVersions
github.comtheupdateframework/go-tuf/v20
theupdateframeworkgo-tuf>= 2.0.0, < 2.3.1, 2.0.0

Timeline

References

Open in Interactive Console →