What’s Vulnerable › Products

AWS tough vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your AWS tough version is affected

Latest AWS tough vulnerabilities

• CVE-2026-6968 — Multiple Path Traversal Variants in awslabs/tough (CVSS 6.5)
• CVE-2026-6967 — Missing Delegated Metadata Validation in awslabs/tough (CVSS 6.5)
• CVE-2026-6966 — Signature Threshold Bypass in awslabs/tough Delegated Roles (CVSS 6.5)
• CVE-2025-2888 — Improper timestamp caching during snapshot rollback in tough (CVSS 4.5)
• CVE-2025-2887 — Failure to detect delegated target rollback in tough (CVSS 4.5)
• CVE-2025-2886 — Terminating targets role delegations are not respected in tough (CVSS 4.5)
• CVE-2025-2885 — Root metadata version not validated in tough (CVSS 4.5)
• CVE-2021-41150 — Improper sanitization of delegated role names in tough (CVSS 6.5)
• CVE-2021-41149 — Improper sanitization of target names in tough (CVSS 8.1)
• CVE-2020-15093 — Improper verification of signature threshold in tough (CVSS 8.6)