CVE-2026-23992: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-23992 is an improper cryptographic signature verification vulnerability in go-tuf, the Go implementation of The Update Framework (TUF). A compromised or misconfigured TUF repository can set signature thresholds to 0 (or a negative value), effectively disabling signature verification entirely and allowing unauthorized modification of TUF metadata. The vulnerability affects github.com/theupdateframework/go-tuf/v2 versions 2.0.0 through 2.3.0 (prior to 2.3.1). It was published on January 20, 2026, with a CVSS v3.1 score of 5.9 (Moderate) per the GitHub Advisory, though Feedly's aggregated data also references a score of 7.5 (High) from NVD (Github Advisory, go-tuf Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). Specifically, the metadata.VerifyDelegate function in the metadata package failed to validate that the configured signature threshold was at least 1 before performing the threshold comparison. This means a TUF repository configured with a threshold of 0 or a negative value would cause the signature threshold computation to always pass, bypassing all integrity checks on TUF metadata files. An attacker who can compromise or misconfigure a TUF repository can exploit this to serve unsigned or maliciously modified metadata to clients without detection. The fix, introduced in commit b38d91f, adds an explicit check that returns an error if roleThreshold < 1 (go-tuf Advisory, Patch Commit).

Successful exploitation allows unauthorized modification of TUF metadata files, both at rest and in transit, as no integrity checks are enforced when the threshold is 0. This directly undermines the software supply chain security guarantees that TUF is designed to provide, enabling an attacker to tamper with software update metadata and potentially deliver malicious packages or updates to downstream clients. Confidentiality and availability are not directly impacted, but the integrity impact is high, as the core trust mechanism of the update framework is nullified (Github Advisory, go-tuf Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.011% (1st percentile), indicating a very low probability of near-term exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to compromise or misconfigure a TUF repository (high attack complexity), limiting the practical attack surface to supply chain scenarios involving malicious or negligently configured repositories.

1. Identify a vulnerable target: Locate a software distribution system or update client using github.com/theupdateframework/go-tuf/v2 versions 2.0.0–2.3.0 that relies on a TUF repository for metadata verification.
2. Compromise or misconfigure the TUF repository: Gain write access to the TUF repository (e.g., via a compromised CI/CD pipeline, insider access, or a misconfigured repository) and set the signature threshold for one or more delegated roles to 0 or a negative value in the TUF metadata.
3. Serve malicious metadata: Modify TUF metadata files (e.g., targets metadata) to reference malicious or tampered software packages, without providing valid signatures.
4. Client fetches unsigned metadata: When a vulnerable go-tuf client calls metadata.VerifyDelegate, the threshold check is bypassed (threshold = 0 always satisfies the comparison), and the unsigned/malicious metadata is accepted as valid.
5. Deliver tampered updates: The client proceeds to download and install software referenced by the attacker-controlled metadata, completing the supply chain compromise (go-tuf Advisory, Patch Commit).

• Logs: TUF client logs showing successful metadata verification for delegated roles without any signature validation errors, particularly when the repository threshold is configured as 0 or a negative value.
• Configuration: TUF repository metadata (e.g., targets.json or delegation metadata files) containing "threshold": 0 or negative threshold values for any delegated role.
• File System: Unexpected or unsigned TUF metadata files present in the repository or local cache that pass verification without valid signatures.
• Network: TUF clients accepting and processing metadata responses from repositories that do not include valid cryptographic signatures for delegated roles.

Upgrade github.com/theupdateframework/go-tuf/v2 to version 2.3.1 or later, which introduces an explicit validation check rejecting any threshold value less than 1 in metadata.VerifyDelegate (Github Advisory, Patch Commit). As an immediate workaround for environments that cannot upgrade, ensure all TUF metadata roles are configured with a signature threshold of at least 1. Audit existing TUF repository configurations to confirm no roles have a threshold of 0 or negative values.

The vulnerability was disclosed by the go-tuf maintainers on January 20, 2026, with credit to contributors 1seal (reviewer), kommendorkapten (developer), and rdimitrov (reviewer). Downstream distributions including SUSE, openSUSE, Fedora, Chainguard, and Wolfi have issued advisories or package updates addressing this CVE, indicating broad ecosystem awareness. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability tracking and Linux distribution security advisories (go-tuf Advisory).