A flaw in the delegated metadata validation in awslabs/tough before version 0.22.0 allows an attacker who is a remote authenticated user with delegated signing authority to bypass TUF specification integrity checks. Because the load_delegations routine does not enforce expiration, hash, or length checks, the attacker can poison the local metadata cache with forged metadata. This violates the integrity guarantees expected from TUF and is classified as a CWE‑345 weakness.

Affects the AWS: tough and AWS: tuftool packages for all versions earlier than tough‑v0.22.0 and tuftool‑v0.15.0. Any deployment that relies on these tools to download or validate software updates from a TUF repository is vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1%, suggesting a very low probability that the vulnerability is actively exploited in the wild. The condition requires the attacker to be an authenticated user with delegated signing authority, so the risk is limited to those with such privileges and to environments that trust delegated metadata without additional safeguards. The vulnerability is not listed in CISA’s KEV catalog.