Critical ELSA-2026-2225 1 CVE

Critical: keylime security update (Oracle Linux 10)

Published Feb 9, 2026 · Updated Feb 9, 2026

Ecosystem: Oracle Linux

Summary

[7.12.1-16]
- CVE-2026-1709: Registrar authentication bypass

[7.12.1-15]
- Registrar allows identity takeover via duplicate UUID registration

[7.12.1-14]
- Properly fix malformed TPM certificates workaround

[7.12.1-13]
- Avoid opening /dev/stdout when printing

[7.12.1-12]
- Fix malformed TPM certificates workaround

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 10	keylime	0:7.12.1-11.el10_1.4
Oracle Linux · 10	keylime-base	0:7.12.1-11.el10_1.4
Oracle Linux · 10	keylime-registrar	0:7.12.1-11.el10_1.4
Oracle Linux · 10	keylime-selinux	0:7.12.1-11.el10_1.4
Oracle Linux · 10	keylime-tenant	0:7.12.1-11.el10_1.4
Oracle Linux · 10	keylime-tools	0:7.12.1-11.el10_1.4
Oracle Linux · 10	keylime-verifier	0:7.12.1-11.el10_1.4
Oracle Linux · 10	python3-keylime	0:7.12.1-11.el10_1.4

Vulnerabilities 1

Critical 9.4

CVE-2026-1709

Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform admini…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 10.0 Extended Update Support Linux PyPI

Feb 6, 2026