CVE-2026-23992

CVE-2026-23992 describes a critical vulnerability in go-tuf, the Go implementation of The Update Framework, affecting versions 2.0.0 through 2.3.0. This flaw allows a compromised or misconfigured TUF repository to disable signature verification by setting signature thresholds to zero, enabling unauthorized modification of TUF metadata files at rest or in transit. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity, requiring no user interaction, and leading to high integrity impact. While there is no direct impact on confidentiality or availability, the compromise of metadata integrity can have severe downstream effects. Currently, there is no evidence of active exploitation, and public exploit code (Metasploit, Nuclei, ExploitDB) is unavailable. Despite this, the vulnerability has garnered significant community discussion with 12 mentions and has been covered in two media articles, suggesting notable attention from security researchers and vendors.