CVE-2026-23992

go-tuf is a Go implementation of The Update Framework TUF. Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to...

CVE-2026-23992

CVE-2026-23992 concerns go-tuf prior to 2.3.1 where a compromised or misconfigured TUF repository can set the signature threshold to 0, effectively bypassing signature verification and allowing unauthorized modification of TUF metadata at rest or in transit (no integrity checks). The issue is lin...