Skip to content
OpenAdvisories
Medium RLSA-2026:28582 1 CVE

Moderate: keylime security update

Published Jun 25, 2026 · Updated Jun 25, 2026

Ecosystem: Rocky Linux

Summary

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 keylime 0:7.14.1-5.el10_2.1

Vulnerabilities 1

  • Medium 6.3
    CVE-2026-6420

    Keylime: keylime: security bypass due to hardcoded tpm quote nonce

    A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quot…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 keylime Linux PyPI

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458889