Skip to main content

Keylime CVE-2026-1709

CRITICAL
Key Exchange without Entity Authentication (CWE-322)
2026-02-06 secalert@redhat.com GHSA-4jqp-9qjv-57m2
Authentication Bypass Enterprise Linux For Ibm Z Systems Enterprise Linux For Arm 64 Eus Keylime Enterprise Linux For Power Little Endian Enterprise Linux Eus Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Little Endian Eus Enterprise Linux Enterprise Linux For Arm 64
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.4 CRITICAL

Unauthenticated network bypass (AV:N/AC:L/PR:N/UI:N); integrity and availability are high via agent deletion, but disclosed data is only public TPM info, so C:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Red Hat
9.4 CRITICAL
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jun 27, 2026 - 05:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 27, 2026 - 05:27 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 27, 2026 - 05:22 vuln.today
cvss_changed
CVSS changed
Jun 27, 2026 - 05:22 NVD
9.4 (CRITICAL) 9.8 (CRITICAL)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Feb 06, 2026 - 20:16 nvd
CRITICAL 9.4

DescriptionNVD

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

AnalysisAI

Authentication bypass in the Keylime registrar (versions 7.12.0 and later) lets unauthenticated network attackers perform administrative actions because the registrar fails to enforce client-side mutual TLS. Attackers connecting without a client certificate can list registered agents, read public TPM data, and delete agents - undermining the integrity of the remote-attestation trust chain. EPSS is low (0.04%, 11th percentile) and there is no public exploit identified at time of analysis, but the flaw is trivially reachable (CVSS 9.8) and patched across Red Hat and SUSE channels.

Technical ContextAI

Keylime is an open-source remote-attestation framework that uses TPM measurements to verify the boot and runtime integrity of nodes; the registrar is the central component that records agent identities and their TPM enrollment keys. The vulnerability maps to CWE-322 (Key Exchange without Entity Authentication): the registrar is intended to require mutual TLS so that only authorized clients (e.g., the verifier/tenant) can invoke administrative endpoints, but since version 7.12.0 it accepts connections that present no client certificate, effectively skipping the client-side leg of the TLS handshake. CPE data confirms the affected component is keylime:keylime (any version in the affected range) as packaged on Red Hat Enterprise Linux 9.0 and 10.0, including EUS streams and the ARM64, IBM Z (s390x), and Power LE architectures.

RemediationAI

Apply the vendor-released patches: update the Keylime packages via the Red Hat errata RHSA-2026:2224, RHSA-2026:2225, or RHSA-2026:2298 as applicable to your RHEL 9/10 stream (https://access.redhat.com/errata/RHSA-2026:2224), or SUSE-SU-2026:20912 for SUSE systems; consult https://access.redhat.com/security/cve/CVE-2026-1709 for the exact fixed package versions for your channel. The fix restores enforcement of client-side TLS authentication on the registrar. Until patched, restrict network reachability of the registrar's administrative port to only the trusted verifier/tenant hosts using host firewall rules or network segmentation (trade-off: misconfigured allow-lists could break legitimate verifier-to-registrar communication), and avoid exposing the registrar on untrusted or management-shared networks. Because the root cause is missing mutual-TLS enforcement, application-layer workarounds are limited - network access control is the primary compensating control until the package update is installed.

More in Enterprise Linux For Ibm Z Systems

View all
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2024-1086 HIGH POC
7.8 Jan 31

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local pr
CVE-2023-46847 HIGH
7.5 Nov 03

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to

CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2019-13272 HIGH POC
7.8 Jul 17

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
CVE-2019-5544 CRITICAL POC
9.8 Dec 06

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. Rated critical severity (CVSS 9.8),

CVE-2025-6021 HIGH POC
7.5 Jun 12

Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
CVE-2022-1227 HIGH POC
8.8 Apr 29

A privilege escalation flaw was found in Podman. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita
CVE-2022-0435 HIGH POC
8.8 Mar 25

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with

Same weakness CWE-322 – Key Exchange without Entity Authentication

View all
CVE-2026-11745 HIGH
8.8
CVE-2025-20163 HIGH
8.7
CVE-2025-62501 HIGH
8.1
CVE-2026-45361 HIGH
8.1
CVE-2026-58065 HIGH
8.1
CVE-2026-1354 MEDIUM
5.9
CVE-2026-33697 HIGH
7.5
CVE-2021-34433 HIGH
7.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.70 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.37 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.61 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.72 Container suse/sl-micro/6.0/toolbox:13.2-9.22 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.59 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.85 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.73 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

CVE-2026-1709 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy