CVE-2026-23992: go-tuf improperly validates the configured threshold for delegations

Analyzed

AliasesUBUNTU-CVE-2026-23992DEBIAN-CVE-2026-23992CGA-2339-3444-2rcm+513 more

Published 22-01-2026Last modified 22-01-2026

Vulnerability summary

CVE-2026-23992 is a high (CVSS 7.5) vulnerability in theupdateframework go-tuf. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 8

OPENSUSE-SU-2026:10235-1 OPENSUSE-SU-2026:20386-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0403-1 SUSE-SU-2026:0757-1 SUSE-SU-2026:0777-1+2 more

Timeline

22-01-2026
PublishedVulnerability first disclosed.
22-01-2026
Last modifiedVulnerability information updated.

Description

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard145 products

aactl< 0.4.12-r39
buildkitd< 0.27.0-r1
buildkitd-fips< 0.27.0-r1
cg< 0.2.201-r0 | < 0.2.194-r0
chainctl< 0.2.206-r0 | < 0.2.194-r0

cloudbeat-8.17< 8.17.10-r5
cloudbeat-8.18< 8.18.8-r5
cloudbeat-8.19< 8.19.10-r0
cloudbeat-9.0< 9.0.8-r5
cloudbeat-9.1< 9.1.10-r0
cloudbeat-9.2< 9.2.2-r0
cloudbeat-fips-8.17< 8.17.10-r6
cloudbeat-fips-8.18< 8.18.8-r5
cloudbeat-fips-8.19< 8.19.10-r0
cloudbeat-fips-9.0< 9.0.8-r5
cloudbeat-fips-9.1< 9.1.10-r0
cloudbeat-fips-9.2< 9.2.4-r0
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
cosign< 3.0.4-r1 | < 3.0.4-r2
cosign-fips< 3.0.4-r2 | < 3.0.4-r3
crossplane-1.20< 1.20.4-r3 | < 1.20.4-r2
crossplane-2.0< 2.0.6-r3 | < 2.0.6-r2
crossplane-2.1< 2.1.3-r2 | < 2.1.3-r4
crossplane-fips-1.20< 1.20.5-r1 | < 1.20.4-r2
crossplane-fips-2.0< 2.0.6-r2 | < 2.0.6-r4
crossplane-fips-2.1< 2.1.3-r2 | < 2.1.3-r4
dockerd-29< 29.2.0-r1
falcoctl< 0.12.2-r0 | < 0.12.1-r0
falcoctl-fips< 0.12.1-r0 | < 0.12.2-r0
flux-source-controller< 1.7.4-r5 | < 1.7.4-r6
flux-source-controller-fips< 1.7.4-r5 | < 1.7.4-r6
gh< 2.86.0-r0
gitsign< 0.13.0-r7 | < 0.14.0-r0
gitsign-credential-cache< 0.13.0-r7
goreleaser< 2.13.3-r1 | < 2.13.3-r3
image-factory< 0.9.0-r5 | < 0.9.0-r4
image-factory-fips< 1.0.2-r0 | < 0.9.0-r4
ko< 0.18.1-r2 | < 0.18.1-r1
ko-fips< 0.18.1-r1 | < 0.18.1-r2
kubescape< 3.0.47-r1 | < 3.0.48-r0
kyverno-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-1.16< 1.16.3-r2 | < 1.16.2-r2
kyverno-background-controller-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-background-controller-1.14< 1.14.5-r10 | < 1.14.5-r3
kyverno-background-controller-1.15< 1.15.3-r11 | < 1.15.2-r5
kyverno-background-controller-1.16< 1.16.3-r2 | < 1.16.2-r2
kyverno-background-controller-fips-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-background-controller-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-background-controller-fips-1.15< 1.15.3-r10 | < 1.15.2-r4
kyverno-background-controller-fips-1.16< 1.16.2-r1 | < 1.16.3-r3
kyverno-cleanup-controller-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-cleanup-controller-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-cleanup-controller-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-cleanup-controller-1.16< 1.16.2-r2 | < 1.16.3-r2
kyverno-cleanup-controller-fips-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-cleanup-controller-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-cleanup-controller-fips-1.15< 1.15.2-r4 | < 1.15.3-r10
kyverno-cleanup-controller-fips-1.16< 1.16.3-r3 | < 1.16.2-r1
kyverno-cli-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-cli-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-cli-1.15< 1.15.2-r5 | < 1.15.3-r11
kyverno-cli-1.16< 1.16.3-r2 | < 1.16.2-r2
kyverno-cli-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-cli-fips-1.14< 1.14.5-r3 | < 1.14.5-r11
kyverno-cli-fips-1.15< 1.15.3-r10 | < 1.15.2-r4
kyverno-cli-fips-1.16< 1.16.2-r1 | < 1.16.3-r3
kyverno-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-fips-1.14< 1.14.5-r3 | < 1.14.5-r11
kyverno-fips-1.15< 1.15.2-r4 | < 1.15.3-r10
kyverno-fips-1.16< 1.16.2-r1 | < 1.16.3-r3
kyverno-init-container-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-init-container-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-init-container-1.15< 1.15.3-r11 | < 1.15.2-r5
kyverno-init-container-1.16< 1.16.3-r2 | < 1.16.2-r2
kyverno-init-container-fips-1.13< 1.13.6-r13 | < 1.13.6-r12
kyverno-init-container-fips-1.14< 1.14.5-r11 | < 1.14.5-r3
kyverno-init-container-fips-1.15< 1.15.2-r4 | < 1.15.3-r10
kyverno-init-container-fips-1.16< 1.16.2-r1 | < 1.16.3-r3
kyverno-notation-aws< 1.1-r35 | < 1.1-r28
kyverno-notation-aws-fips< 1.1-r28 | < 1.1-r34
kyverno-policy-reporter-plugins-kyverno< 0.5.3-r1 | < 0.5.3-r2
kyverno-policy-reporter-plugins-kyverno-fips< 0.5.3-r3 | < 0.5.3-r1
kyverno-reports-controller-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-reports-controller-1.14< 1.14.5-r3 | < 1.14.5-r10
kyverno-reports-controller-1.15< 1.15.3-r11 | < 1.15.2-r5
kyverno-reports-controller-1.16< 1.16.3-r2 | < 1.16.2-r2
kyverno-reports-controller-fips-1.13< 1.13.6-r12 | < 1.13.6-r13
kyverno-reports-controller-fips-1.14< 1.14.5-r3 | < 1.14.5-r11
kyverno-reports-controller-fips-1.15< 1.15.2-r4 | < 1.15.3-r10
kyverno-reports-controller-fips-1.16< 1.16.2-r1 | < 1.16.3-r3
neuvector-sigstore-interface< 0_git20251212-r1 | < 0_git20251212-r5
neuvector-sigstore-interface-fips< 0_git20260119-r0 | < 0_git20260130-r0
policy-controller< 0.15.1-r0 | < 0.14.0-r0
policy-controller-fips< 0.15.1-r0 | < 0.14.0-r0
policy-controller-tester< 0.15.1-r0 | < 0.14.0-r0
policy-controller-tester-fips< 0.14.0-r0 | < 0.15.1-r0
ratify< 1.4.0-r9
ratify-fips< 1.4.0-r9
rekor-backfill-index< 1.5.0-r0
rekor-cli< 1.5.0-r0
rekor-fips-backfill-index< 1.5.0-r0
rekor-fips-cli< 1.5.0-r0
rekor-fips-server< 1.5.0-r0
rekor-server< 1.5.0-r0
reports-server< 0.1.6-r0
sigstore-scaffolding-fips-tuf-server< 0.7.31-r4 | < 0.7.31-r6
sigstore-scaffolding-tuf-server< 0.7.31-r3 | < 0.7.31-r5
skaffold< 2.17.1-r5 | < 2.17.1-r1
skaffold-fips< 2.17.1-r1 | < 2.17.1-r2
slsa-verifier< 2.7.1-r11 | < 2.7.1-r6
spire-agent< 1.14.1-r1 | < 1.14.1-r0
spire-agent-fips< 1.14.1-r0 | < 1.14.1-r3
tekton-chains< 0.26.0-r4 | < 0.26.0-r3
tekton-chains-fips< 0.26.0-r3 | < 0.26.0-r6
teleport-15-kube-agent-updater< 15.5.4-r9
teleport-16-kube-agent-updater< 16.5.18-r6
teleport-17< 17.7.13-r0 | < 17.7.20-r6
teleport-17-kube-agent-updater< 17.7.20-r6 | < 17.7.20-r5 | < 17.7.13-r0
teleport-17-operator< 17.7.20-r6
teleport-18< 18.6.1-r2 | < 18.7.2-r7 | < 18.7.2-r8
teleport-18-kube-agent-updater< 18.7.2-r7 | < 18.7.2-r8 | < 18.6.1-r2
teleport-18-operator< 18.7.2-r7 | < 18.7.2-r8
teleport-18.6< 18.6.8-r9
teleport-18.6-kube-agent-updater< 18.6.8-r9
teleport-18.6-operator< 18.6.8-r9
teleport-operator-fips-17< 17.7.23-r0
teleport-operator-fips-18< 18.7.5-r0
tflint< 0.60.0-r4
tflint-fips< 0.60.0-r4
tkn< 0.43.0-r2 | < 0.43.0-r5
tkn-fips< 0.43.0-r3 | < 0.43.0-r4
trivy< 0.68.2-r1 | < 0.69.0-r0
trivy-fips< 0.68.2-r1 | < 0.69.0-r0
trivy-operator< 0.29.0-r6 | < 0.29.0-r9
trivy-operator-fips< 0.29.0-r6 | < 0.29.0-r9
vexctl< 0.4.1-r7 | < 0.4.1-r5
witness< 0.10.2-r2 | < 0.10.2-r0
zarf< 0.69.0-r1 | < 0.70.1-r2
zot< 2.1.14-r0 | < 2.1.13-r0

Show all 145

Wolfi43 products

aactl< 0.4.12-r39
buildkitd< 0.27.0-r1
cosign< 3.0.4-r1 | < 3.0.4-r2
crossplane-2.1< 2.1.3-r2 | < 2.1.3-r4
dockerd-29< 29.2.0-r1

Show all 43

Debian1 product

golang-github-theupdateframework-go-tufAll versions (No fix recorded) | < 2.4.1+0.7.0-1

Github.com/theupdateframework/go-tuf1 product

v2< 2.3.1

Theupdateframework1 product

go-tuf≥ 2.0.0, < 2.3.1

Ubuntu1 product

golang-github-theupdateframework-go-tufAll versions (No fix recorded)

6 vendors · 192 products

References

9 links

github.com/theupdateframework/go-tuf/security/advisories/GHSA-fphv-w9fq-2525X Refsource CONFIRMREPORTAdvisoryWEBPatchVendor Advisory
github.com/theupdateframework/go-tuf/commit/b38d91fdbc69dfe31fe9230d97dafe527ea854a0X Refsource MISCREPORTFIXWEBPatch
ubuntu.com/security/CVE-2026-23992REPORT
www.cve.org/CVERecord?id=CVE-2026-23992REPORT
security-tracker.debian.org/tracker/CVE-2026-23992Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23992.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-23992AdvisoryOval
github.com/theupdateframework/go-tufPACKAGE
github.com/theupdateframework/go-tuf/releases/tag/v2.3.1WEB