Skip to content
cve.newCreate a CVE report

tuf

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium4.0
CVE-2026-123806Package fixes recorded

tuf has platform-dependent delegation path matching

DelegatedRole._is_target_in_pathpattern uses fnmatch.fnmatch to decide whether a given target path is authorized by a delegation's glob pattern.

Recorded fixes — tuf: 7.0.0. Check your release branch.

Exploitation not established

PyPI / tuf
tuf PyPI
Affected range Recorded fix
Earlier releases before 7.0.0Ecosystem versions7.0.0

Version evidence: OSV · GHSA-qp9x-wp8f-qgjj

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "7.0.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.10.0",
    "0.10.1",
    "0.10.2",
    "0.11.0",
    "0.11.1",
    "0.11.2.dev1",
    "0.11.2.dev2",
    "0.11.2.dev3",
    "0.11.dev0",
    "0.12.0",
    "0.12.1",
    "0.12.2",
    "0.12.dev0",
    "0.12.dev1",
    "0.12.dev2",
    "0.13.0",
    "0.14.0",
    "0.15.0",
    "0.16.0",
    "0.17.0",
    "0.18.0",
    "0.18.1",
    "0.19.0",
    "0.20.0",
    "0.7.5",
    "0.9.8",
    "0.9.9",
    "1.0.0",
    "1.1.0",
    "2.0.0",
    "2.1.0",
    "3.0.0",
    "3.1.0",
    "3.1.1",
    "4.0.0",
    "5.0.0",
    "5.1.0",
    "6.0.0"
  ]
}