CVE-2026-6966: Amazon Tough

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata. We recommend you upgrade to tough-v0.22.0 / tuftool-v0.15.0.

Affected products

• Amazon Tough: before 0.22.0 (fixed in 0.22.0)
• Amazon Tuftool: before 0.15.0 (fixed in 0.15.0)

Published 2026-04-24. Last modified 2026-06-17.