Vulnerability in Go Implementation of The Update Framework by The Update Framework
CVE-2026-23992

5.9MEDIUM

Key Information:

Vendor

Theupdateframework

Status
Go-tuf
Vendor
CVE Published:
22 January 2026

What is CVE-2026-23992?

The go-tuf library, an implementation of The Update Framework, is susceptible to a vulnerability due to potentially compromised or misconfigured repositories. Specifically, if signature thresholds are incorrectly set to 0, it undermines signature verification, allowing unauthorized modification of TUF metadata files both at rest and in transit. This issue can lead to significant security risks, making it crucial for users to upgrade to version 2.3.1 or adjust configurations to ensure a minimum threshold of 1 for metadata roles.

Affected Version(s)

go-tuf >= 2.0.0, < 2.3.1

References

https://github.com/theupdateframework/go-tuf/security/adv...
x_refsource_CONFIRM
https://github.com/theupdateframework/go-tuf/commit/b38d9...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.