Keylime
CVE-2026-1709
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network bypass (AV:N/AC:L/PR:N/UI:N); integrity and availability are high via agent deletion, but disclosed data is only public TPM info, so C:L.
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
AnalysisAI
Authentication bypass in the Keylime registrar (versions 7.12.0 and later) lets unauthenticated network attackers perform administrative actions because the registrar fails to enforce client-side mutual TLS. Attackers connecting without a client certificate can list registered agents, read public TPM data, and delete agents - undermining the integrity of the remote-attestation trust chain. EPSS is low (0.04%, 11th percentile) and there is no public exploit identified at time of analysis, but the flaw is trivially reachable (CVSS 9.8) and patched across Red Hat and SUSE channels.
Technical ContextAI
Keylime is an open-source remote-attestation framework that uses TPM measurements to verify the boot and runtime integrity of nodes; the registrar is the central component that records agent identities and their TPM enrollment keys. The vulnerability maps to CWE-322 (Key Exchange without Entity Authentication): the registrar is intended to require mutual TLS so that only authorized clients (e.g., the verifier/tenant) can invoke administrative endpoints, but since version 7.12.0 it accepts connections that present no client certificate, effectively skipping the client-side leg of the TLS handshake. CPE data confirms the affected component is keylime:keylime (any version in the affected range) as packaged on Red Hat Enterprise Linux 9.0 and 10.0, including EUS streams and the ARM64, IBM Z (s390x), and Power LE architectures.
RemediationAI
Apply the vendor-released patches: update the Keylime packages via the Red Hat errata RHSA-2026:2224, RHSA-2026:2225, or RHSA-2026:2298 as applicable to your RHEL 9/10 stream (https://access.redhat.com/errata/RHSA-2026:2224), or SUSE-SU-2026:20912 for SUSE systems; consult https://access.redhat.com/security/cve/CVE-2026-1709 for the exact fixed package versions for your channel. The fix restores enforcement of client-side TLS authentication on the registrar. Until patched, restrict network reachability of the registrar's administrative port to only the trusted verifier/tenant hosts using host firewall rules or network segmentation (trade-off: misconfigured allow-lists could break legitimate verifier-to-registrar communication), and avoid exposing the registrar on untrusted or management-shared networks. Because the root cause is missing mutual-TLS enforcement, application-layer workarounds are limited - network access control is the primary compensating control until the package update is installed.
More in Enterprise Linux
View allIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
Same weakness CWE-322 – Key Exchange without Entity Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.70 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.37 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.61 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.72 Container suse/sl-micro/6.0/toolbox:13.2-9.22 | Affected |
| Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.59 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.85 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.73 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd | Affected |
| SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Desktop 15 SP7 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP4 | Fixed |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP5 | Fixed |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| SUSE Manager Proxy 4.3 | Fixed |
| SUSE Manager Proxy LTS 4.3 | Fixed |
| SUSE Manager Retail Branch Server 4.3 | Fixed |
| SUSE Manager Retail Branch Server LTS 4.3 | Fixed |
| SUSE Manager Server 4.3 | Fixed |
| SUSE Manager Server LTS 4.3 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP4 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP5 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Fixed |
| SUSE Linux Enterprise Real Time 15 SP4 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today
GHSA-4jqp-9qjv-57m2