Key points
- tough versions 0.1.0 through 0.21.x are affected.
- tuftool versions 0.1.0 through 0.14.x are affected.
- No workarounds are available; upgrading is required.
AWS has released security updates for the tough library and the tuftool command-line utility. These components are used for managing The Update Framework repositories.
What happened
AWS published bulletin 2026-019-AWS on 24 April 2026. The advisory identifies multiple security issues in the tough library and the tuftool CLI. tough is a Rust library for generating and signing TUF repositories. tuftool provides the command-line interface for repository management operations. The affected versions of tough range from 0.1.0 through 0.21.x inclusive. The affected versions of tuftool range from 0.1.0 through 0.14.x inclusive.
Why it matters
The issues have been addressed in tough version 0.22.0 and later. They have also been fixed in tuftool version 0.15.0 and later. AWS states that there are no known workarounds for these issues. Upgrading to the patched versions is required to resolve the vulnerabilities. Teams should also review any forked or derivative code. This ensures that security fixes are incorporated into custom implementations. Emily Albini of Oxide Computer Company collaborated on the disclosure. Oleh Konko of 1seal.org also assisted with the coordinated process.
What happens next
- Upgrade tough to version 0.22.0 or later.
- Upgrade tuftool to version 0.15.0 or later.
- Review forked code for necessary security updates.
- Contact [email protected] with security concerns.
Patch priority
Teams usually prioritise systems that generate or sign update metadata first. Check whether internal build pipelines depend on vulnerable library versions. Test the upgraded components in a staging environment before rolling them out to production. Back up current repository configurations to allow for rapid rollback if issues arise. Since no workarounds exist, exposure remains high until the patch is applied. Monitor logs for any unusual activity during the transition period.
What to do and how to stay safe: AWS
- Audit your inventory for tough versions below 0.22.0.
- Audit your inventory for tuftool versions below 0.15.0.
- Apply the vendor-provided updates to all affected systems.
- Verify that forked code includes the latest security fixes.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of tough are affected?
Versions 0.1.0 through 0.21.x inclusive are affected.
Which versions of tuftool are affected?
Versions 0.1.0 through 0.14.x inclusive are affected.
Are there any workarounds?
No, there are no known workarounds; upgrading is required.
