5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23992

CVE-2026-23992: go-tuf improperly validates the configured threshold for delegations

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23992

CVE-2026-23992:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/theupdateframework/go-tuf/v2	go	< 2.3.1	2.3.1
github.com/theupdateframework/go-tuf	go	<= 0.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly mentions that the metadata.VerifyDelegate function improperly validates the configured threshold for delegations, allowing a value of 0 to disable signature verification. To pinpoint the exact vulnerable function and the fix, I analyzed the commits between the last vulnerable version (v2.3.0) and the first patched version (v2.3.1) of the theupdateframework/go-tuf repository. The commit b38d91fdbc69dfe31fe9230d97dafe527ea854a0, with the message "Verify threshold is valid", directly addresses this issue. The changes in metadata/metadata.go clearly show the addition of a check within the VerifyDelegate function to ensure the roleThreshold is greater than or equal to 1. This confirms that Metadata.VerifyDelegate is the vulnerable function, as it was responsible for processing the threshold without proper validation.

Vulnerable functions

Metadata.VerifyDelegate

metadata/metadata.go

The vulnerability lies in the `VerifyDelegate` function, which, prior to the patch, did not validate the signature threshold (`roleThreshold`). A malicious or misconfigured repository could set this threshold to 0 or a negative number, effectively disabling signature verification for delegated roles. The patch introduces a check to ensure the threshold is at least 1, preventing this bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.