CoreCVE
Back

HIGH

go-tuf improperly validates the configured threshold for delegations

Published Jan 22, 2026

Description

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

Affected products

Remediation

Red Hat statement

The state of a TUF repository is outside the control of the attacker prior to compromise. Following documented Red Hat guidance for repository creation will ensure that these preconditions are not present.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-347

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jan 22, 2026
Updated Jan 22, 2026
Reserved Jan 19, 2026
Link CVE-2026-23992
CISA Vulnrichment
Updated Jan 22, 2026
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-23992
Red Hat
Severity Moderate
Public date Jan 22, 2026
Links CVE-2026-23992 - Bugzilla
ENISA EUVD
Assigner GitHub_M
Published Jan 22, 2026
Updated Jan 22, 2026
Exploited since n/a
Link EUVD-2026-3672
EUVD-2026-3672 GHSA-FPHV-W9FQ-2525