Amazon Tuftool vulnerabilities

3 CVEs affecting Amazon Tuftool, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-6968, published 2026-04-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-6968, published 2026-04-24. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute…
CVE-2026-6966, published 2026-04-24. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold…
CVE-2026-6967, published 2026-04-24. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass…