Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough‑v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata. Because load_delegations does not apply the same validation checks as the top‑level targets metadata path, an attacker can poison the local metadata cache with forged metadata. This undermines the integrity guarantees expected from TUF and is a CWE‑345 weakness.

Affects the AWS: tough and AWS: tuftool packages for all versions earlier than tough‑v0.22.0 and tuftool‑v0.15.0. Any deployment that relies on these tools to download or validate software updates from a TUF repository is vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1%, suggesting a very low probability that the vulnerability is actively exploited in the wild. The condition requires the attacker to be an authenticated user with delegated signing authority, so the risk is limited to those with such privileges and to environments that trust delegated metadata without additional safeguards. The vulnerability is not listed in CISA’s KEV catalog.