CVE-2026-24686
MediumCVSS 4.7Summary
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (repoName) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a repoName containing traversal (e.g., ../escaped-repo) and cause go-tuf to create directories and write the root metadata file outside the intended LocalMetadataDir cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Risk Assessment
An attacker can write files outside the intended cache directory, potentially overwriting or placing metadata in unexpected locations. This may compromise the integrity of the update process or affect other files within the process's permissions.
Recommendation
Upgrade go-tuf to version 2.4.1 or later. Avoid accepting map files from untrusted sources.
Other vulnerabilities in go-tuf
See all- CVE-2026-23992Medium
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification of TUF metadata files at rest or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always ensure that TUF metadata roles are configured with a threshold of at least 1.
- CVE-2026-23991Medium
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to 2.3.1, if the TUF repository (or any mirror) returns invalid TUF metadata JSON (valid JSON but not well-formed TUF metadata), the client panics during parsing, causing denial of service. The panic occurs before signature validation, so a compromised repository/mirror/cache can DoS clients without any signing key.
Original NVD description (English source)
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS