What’s Vulnerable › Vulnerabilities

CVE-2025-2886: Terminating targets role delegations are not respected in tough

• Severity: medium (CVSS 4.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-27 · updated 2026-06-17
• Weakness: CWE-670

Description

Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a terminating delegation. This could cause the client to fetch a target from an incorrect source, altering the target contents. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

• AWS tough: before 0.20.0 — fixed in 0.20.0

How to fix

Upgrade to a fixed version: AWS tough 0.20.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-007/
• https://github.com/awslabs/tough/releases/tag/tough-v0.20.0
• https://github.com/awslabs/tough/security/advisories/GHSA-v4wr-j3w6-mxqc

Get alerted when CVE-2025-2886 or the next vulnerability affects your stack