python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0,     DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies     os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When     a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is     visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong     delegation for a requested path. Linux and macOS clients are not affected because their path normalization     does not change case. This issue is fixed in 7.0.0. (CVE-2026-123806)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0,
    DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies
    os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When
    a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is
    visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong
    delegation for a requested path. Linux and macOS clients are not affected because their path normalization
    does not change case. This issue is fixed in 7.0.0. (CVE-2026-123806)

ID	Name	Product	Family	Type	Severity
379139	Linux Distros Unpatched Vulnerability : CVE-2026-123806	Nessus	Misc.	Local	medium
442447	SCA: security update for tuf (GHSA-qp9x-wp8f-qgjj)	Tenable Cloud Security	SCA Checks	Local	medium
442447	SCA: security update for tuf (GHSA-qp9x-wp8f-qgjj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-123806

medium

Tenable Plugins

medium

medium

medium