CVE-2026-123806 | Update Framework python-tuf up to 6.x Path Pattern Matching tuf/api/_payload.py DelegatedRole._is_target_in_pathpattern improper authorization

November 9, 2026 Yanac

A vulnerability, which was classified as problematic, was found in Update Framework python-tuf up to 6.x. Impacted is the function DelegatedRole._is_target_in_pathpattern of the file tuf/api/_payload.py of the component Path Pattern Matching. Executing a manipulation can lead to improper authorization.

This vulnerability is tracked as CVE-2026-123806. The attack can be launched remotely. No exploit exists.

You should upgrade the affected component.VulDB Recent EntriesRead More