AWS tough vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 20263

Newest CVEs

• CVE-2026-6968

  Multiple Path Traversal Variants in awslabs/tough

  AWS · tough

  High7.1
• CVE-2026-6967

  Missing Delegated Metadata Validation in awslabs/tough

  AWS · tough

  High7.1
• CVE-2026-6966

  Signature Threshold Bypass in awslabs/tough Delegated Roles

  AWS · tough

  High7.0
• CVE-2025-2888

  Improper timestamp caching during snapshot rollback in tough

  AWS · tough

  Medium5.7
• CVE-2025-2887

  Failure to detect delegated target rollback in tough

  AWS · tough

  Medium5.7
• CVE-2025-2886

  Terminating targets role delegations are not respected in tough

  AWS · tough

  Medium5.7
• CVE-2025-2885

  Root metadata version not validated in tough

  AWS · tough

  Medium5.7