Man-in-the-Middle (MitM)

tuf is vulnerable to man-in-the-middle attack. An attacker who is able to control the trust chain for future updates by serving multiple new versions of root metadata culminating in a version which has not been correctly signed. The vulnerability exists as the reference implementation incorrectly trust a previously downloaded root metadata file which failed verification at download time.