go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b87863841 advisory.

    Upstream release 2.98.0. https://github.com/jfrog/jfrog-cli/releases/tag/v2.98.0

    Resolves the following security issues:
    CVE-2025-11579     CVE-2025-66564     CVE-2026-23831     CVE-2026-23991     CVE-2026-23992     CVE-2026-24117     CVE-2026-24137     CVE-2026-24686     CVE-2026-32285     CVE-2026-33762     CVE-2026-34165     CVE-2026-34986

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1507 advisory.

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC)     identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to     bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can     trigger GET requests, the request cannot mutate state. The response from the GET request is not returned     to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal     network through Blind SSRF. This vulnerability is fixed in 1.8.5. (CVE-2026-22772)

    sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3     and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs     a filesystem path by joining a cache base directory with a target name sourced from signed target     metadata; however, it does not validate that the resulting path stays within the cache base directory. A     malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the     calling process has. Note that this should only affect clients that are directly using the TUF client in     sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are     unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed     in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting     SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-     go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release. (CVE-2026-24137)

    go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map     file repository name string (`repoName`) as a filesystem path component when selecting the local metadata     cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map     file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g.,     `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the     intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1     contains a patch. (CVE-2026-24686)

    url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
    (CVE-2026-25679)

    On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the     returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of     this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem     without permitting reading or writing files outside the root. (CVE-2026-27139)

    Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS     if the meta tag also has an http-equiv attribute with the value refresh. A new GODEBUG setting has been     added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content     attribute which follow url= by setting htmlmetacontenturlescape=0. (CVE-2026-27142)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de52e7caa1 advisory.

    Update to 2.87.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-21a2f3709a advisory.

    Update to 2.87.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map
    file repository name string (`repoName`) as a filesystem path component when selecting the local metadata
    cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map
    file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g.,
    `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the
    intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1
    contains a patch. (CVE-2026-24686)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map     file repository name string (`repoName`) as a filesystem path component when selecting the local metadata     cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map     file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g.,     `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the     intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1     contains a patch. (CVE-2026-24686)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
311385	Fedora 44 : jfrog-cli (2026-6b87863841)	Nessus	Fedora Local Security Checks	Local	high
304588	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1507)	Nessus	Amazon Linux Local Security Checks	Local	medium
301422	Fedora 42 : gh (2026-de52e7caa1)	Nessus	Fedora Local Security Checks	Local	high
300473	Fedora 43 : gh (2026-21a2f3709a)	Nessus	Fedora Local Security Checks	Local	high
437371	SCA: security update for github.com/theupdateframework/go-tuf/v2 (GHSA-jqc5-w2xx-5vq4)	Tenable Cloud Security	SCA Checks	Local	medium
437371	SCA: security update for github.com/theupdateframework/go-tuf/v2 (GHSA-jqc5-w2xx-5vq4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
296739	Linux Distros Unpatched Vulnerability : CVE-2026-24686	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-24686

medium

Tenable Plugins

high

medium

high

high

medium

medium

medium