CVE-2026-123806

Name of the Vulnerable Software and Affected Versions python-tuf versions prior to 7.0.0

Description In the ngclient implementation, the DelegatedRole. is target in pathpattern() function in tuf/api/ payload.py uses fnmatch.fnmatch to verify if a target path is authorized by a delegation glob pattern. On Windows, fnmatch.fnmatch applies os.path.normcase, which converts strings to lowercase, making the path authorization case-insensitive. This behavior deviates from the TUF specification and differs from Linux and macOS. If a repository contains path-based delegations that differ only by case and an attacker-controlled role is processed before the legitimate role, a Windows client may accept an unauthorized target provided by the attacker for a requested path.

Recommendations Update python-tuf to version 7.0.0 or later.