CVE-2026-123806

The python-tuf library (prior to version 7.0.0 ) contains a platform-dependent bug where delegation path authorization is case-insensitive on Windows but case-sensitive on Linux and macOS. This is caused by the use of fnmatch.fnmatch in tuf/api/_payload.py, which invokes os.path.normcase and lowe...