CVE-2025-2888: medium-severity vulnerability in AWS tough
Improper timestamp caching during snapshot rollback in tough
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.3%
During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
AWS · toughRelated CVEs — AWS tough
In the same product, most dangerous first.
CVE-2026-6968HIGHMultiple Path Traversal Variants in awslabs/toughEPSS 0.5%CVE-2025-2887MEDIUMFailure to detect delegated target rollback in toughEPSS 0.3%CVE-2025-2886MEDIUMTerminating targets role delegations are not respected in toughEPSS 0.3%CVE-2025-2885MEDIUMRoot metadata version not validated in toughEPSS 0.3%CVE-2026-6966HIGHSignature Threshold Bypass in awslabs/tough Delegated RolesEPSS 0.3%CVE-2026-6967HIGHMissing Delegated Metadata Validation in awslabs/toughEPSS 0.3%