Case-Insensitive Path Vulnerability in Python TUF by The Update Framework

CVE-2026-123806

What is CVE-2026-123806?

The python-tuf library, which implements The Update Framework, experienced a vulnerability in versions prior to 7.0.0 that affected its handling of delegated roles. Specifically, the method DelegatedRole._is_target_in_pathpattern improperly used case-insensitive matching on Windows systems, which could allow an attacker to exploit a path-based delegation. If an attacker could manipulate delegation paths to differ only by case, it might lead to unauthorized access by allowing a target from an attacker-controlled role to be accepted instead of from the legitimate role. This vulnerability does not affect Linux and macOS systems due to their case-sensitive path normalization. Users are strongly advised to upgrade to version 7.0.0 or newer to mitigate this risk.

References