{"cve":"CVE-2026-23992","nvd":{"published":"2026-01-22T03:15:47.470","modified":"2026-06-17T10:22:26.730","status":"Analyzed","description":"go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-347"],"references":["https://github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0","https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525"],"products":["theupdateframework:go-tuf"],"source":"nvd","synced_at":"2026-10-19T22:21:16.563232421+00:00"},"epss":{"cve":"CVE-2026-23992","score":0.00215,"percentile":0.11901,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-fphv-w9fq-2525","url":"https://osv.dev/vulnerability/GHSA-fphv-w9fq-2525","summary":"go-tuf improperly validates the configured threshold for delegations","modified":"2026-09-10T03:50:33.034443766Z","packages":[{"ecosystem":"Go","name":"github.com/theupdateframework/go-tuf/v2","purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2","ranges":["<2.3.1"],"fixed":["2.3.1"]}]},{"id":"GO-2026-4349","url":"https://osv.dev/vulnerability/GO-2026-4349","summary":"Improper validattion of configured threshold for delegations in github.com/theupdateframework/go-tuf","modified":"2026-02-26T18:26:44Z","packages":[{"ecosystem":"Go","name":"github.com/theupdateframework/go-tuf/v2","purl":"pkg:golang/github.com/theupdateframework/go-tuf/v2","ranges":["<2.3.1"],"fixed":["2.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}