The vulnerability in go-tuf allows a compromised or misconfigured TUF repository to set the signature verification threshold to zero, effectively disabling all integrity checks. This bypass creates a condition where any attacker who can alter the metadata or has control over the repository can inject malicious or incorrect information without detection. The most significant impact is the loss of trust in the update framework, potentially leading to malicious updates or replay attacks. The flaw is rooted in improper validation of a configuration value, classified as CWE-347.

The Update Framework’s go-tuf library, version 2.0.0 through 2.3.0, is affected. The product is thego-tuf implementation provided by theupdateframework. Any project or system that incorporates these vulnerable library versions is at risk until the library is updated or the configuration is corrected.

With a CVSS score of 5.9 and an EPSS score below 1%, the technical severity is moderate and the exploitation probability is currently low. The vulnerability is not in the CISA KEV catalog. The likely attack vector is a compromised or deliberately misconfigured TUF repository where an adversary can set the signature threshold to zero, thereby disabling signature verification for all roles. Once this threshold is disabled, the attacker can modify metadata files at rest or during transit, leading to unauthorized updates or compromised integrity of software distributions.