Summary
Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.
Security Fix(es):
* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | keylime | 0:7.12.1-11.el9_7.4 |
Vulnerabilities 1
-
Critical 9.4
Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform admini…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2435514