Description
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Keylime Project | keylime | < 7.14.0 | 7.14.0 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | keylime +7 | 7.12.1-11.el10_1.3 | RHSA-2025:23201 |
| RHEL 9 | keylime +6 | 7.12.1-11.el9_7.3 | RHSA-2025:23210 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | keylime +6 | 7.12.1-2.el10_0.4 | RHSA-2026:0429 |
| RHEL 9.6 EUS | keylime +6 | 7.3.0-15.el9_6.1 | RHSA-2025:23628 |
| RHEL 9.4 EUS | keylime +6 | 7.3.0-13.el9_4.1 | RHSA-2025:23852 |
| RHEL 9.2 E4S | keylime +6 | 6.5.2-6.el9_2.1 | RHSA-2025:23735 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | keylime-selinux | 7.12.1-11.el10_1.3 | ALSA-2025:23201 |
| AlmaLinux 9 | keylime +6 | 7.12.1-11.el9_7.3 | ALSA-2025:23210 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | keylime | 7.12.1-11.el10_1.3 | RLSA-2025:23201 |
| Rocky Linux 9 | keylime | 7.12.1-11.el9_7.3 | RLSA-2025:23210 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLES 15 SP6 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLES 15 SP5 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLES 15 SP4 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | keylime | 7.13.0+40-160000.1.1 | SUSE-SU-2025:21194-1 |
| SLES for SAP 15 SP6 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLES for SAP 15 SP5 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLES for SAP 15 SP4 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLES 16.0 | keylime | 7.13.0+40-160000.1.1 | SUSE-SU-2025:21194-1 |
| SLE HPC 15 SP5 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
| SLE HPC 15 SP4 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | keylime | 7.13.0+40-1.1 | openSUSE-SU-2025:15811-1 |
| openSUSE Leap 16.0 | keylime | 7.13.0+40-160000.1.1 | openSUSE-SU-2025:20159-1 |
| openSUSE Leap 15.6 | keylime | 6.3.2-150400.4.23.1 | SUSE-SU-2026:0217-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | keylime +7 | 7.12.1-11.el10_1.3 | ELSA-2025-23201 |
| Oracle Linux 9 | keylime +6 | 7.12.1-11.el9_7.3 | ELSA-2025-23210 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keylime | < 7.13.0 | 7.13.0 | GHSA-xh5w-g8gq-r3v9 |
| PyPI | keylime | — | — | PYSEC-2025-77 |
Advisories 17
- ALSA-2025:23210 Important: keylime security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23201 Important: keylime security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:0429 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:23852 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:23735 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:23628 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:23210 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:23201 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- openSUSE-SU-2025:20159-1 Security update for keylime SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15811-1 keylime-config-7.13.0+40-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0217-1 Security update for keylime SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21194-1 Security update for keylime SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2849 Red Hat Enterprise Linux (Keylime): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 17, 2026
- RLSA-2025:23201 Important: keylime security update Rocky Linux Security Advisories · Dec 18, 2025
- RLSA-2025:23210 Important: keylime security update Rocky Linux Security Advisories · Dec 17, 2025
- ELSA-2025-23201 Important: keylime security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 16, 2025
- ELSA-2025-23210 Important: keylime security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 16, 2025
References
- RHSA-2025:23201 vendor-advisory
- RHSA-2025:23210 vendor-advisory
- RHSA-2025:23628 vendor-advisory
- RHSA-2025:23735 vendor-advisory
- RHSA-2025:23852 vendor-advisory
- RHSA-2026:0429 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-13609 vdb-entry
- RHBZ#2416761 issue-tracking
- https://github.com/keylime/keylime/issues/1820