Summary
Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.
Security Fix(es):
* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | keylime | 7.12.1-11.el9_7.4 |
| AlmaLinux · 9 | keylime-base | 7.12.1-11.el9_7.4 |
| AlmaLinux · 9 | keylime-registrar | 7.12.1-11.el9_7.4 |
| AlmaLinux · 9 | keylime-selinux | 7.12.1-11.el9_7.4 |
| AlmaLinux · 9 | keylime-tenant | 7.12.1-11.el9_7.4 |
| AlmaLinux · 9 | keylime-verifier | 7.12.1-11.el9_7.4 |
| AlmaLinux · 9 | python3-keylime | 7.12.1-11.el9_7.4 |
Vulnerabilities 1
-
Critical 9.4
Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform admini…