CVE-2026-23992CWE-347

go-tuf improperly validates the configured threshold for delegations

Medium · published January 22, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-01-22T02:20Z
EPSS history
Timeline
  • 22 JAN 02:20Z
    go-tuf improperly validates the configured threshold for delegations
    cvelistv5