CVE-2025-2885: medium-severity vulnerability in AWS tough
Root metadata version not validated in tough
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.3%
Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of the intended version in the root metadata file, altering the version fetched by the client. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
AWS · toughRelated CVEs — AWS tough
In the same product, most dangerous first.
CVE-2026-6968HIGHMultiple Path Traversal Variants in awslabs/toughEPSS 0.5%CVE-2025-2888MEDIUMImproper timestamp caching during snapshot rollback in toughEPSS 0.3%CVE-2025-2887MEDIUMFailure to detect delegated target rollback in toughEPSS 0.3%CVE-2025-2886MEDIUMTerminating targets role delegations are not respected in toughEPSS 0.3%CVE-2026-6966HIGHSignature Threshold Bypass in awslabs/tough Delegated RolesEPSS 0.3%CVE-2026-6967HIGHMissing Delegated Metadata Validation in awslabs/toughEPSS 0.3%