Description
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | keylime +7 | 7.12.1-11.el10_1.4 | RHSA-2026:2225 |
| RHEL 9 | keylime +6 | 7.12.1-11.el9_7.4 | RHSA-2026:2224 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | keylime +7 | 7.12.1-2.el10_0.5 | RHSA-2026:2298 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | keylime-selinux | 7.12.1-11.el10_1.4 | ALSA-2026:2225 |
| AlmaLinux 9 | keylime +6 | 7.12.1-11.el9_7.4 | ALSA-2026:2224 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | keylime | 7.12.1-11.el10_1.4 | RLSA-2026:2225 |
| Rocky Linux 9 | keylime | 7.12.1-11.el9_7.4 | RLSA-2026:2224 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | keylime | 7.14.0+0-160000.1.1 | SUSE-SU-2026:20912-1 |
| SLES 16.0 | keylime | 7.14.0+0-160000.1.1 | SUSE-SU-2026:20912-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | keylime | 7.14.0+0-1.1 | openSUSE-SU-2026:10165-1 |
| openSUSE Leap 16.0 | keylime | 7.14.0+0-160000.1.1 | openSUSE-SU-2026:20398-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | keylime +7 | 7.12.1-11.el10_1.4 | ELSA-2026-2225 |
| Oracle Linux 9 | keylime +6 | 7.12.1-11.el9_7.4 | ELSA-2026-2224 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keylime | >= 7.12.0, < 7.12.2 | 7.12.2 | GHSA-4jqp-9qjv-57m2 |
| PyPI | keylime | >= 7.13.0, < 7.13.1 | 7.13.1 | GHSA-4jqp-9qjv-57m2 |
| PyPI | keylime | < 7.12.0 | 7.12.0 | PYSEC-2026-74 |
Advisories 13
- ALSA-2026:2224 Critical: keylime security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:2225 Critical: keylime security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:2298 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jul 29, 2026
- RHSA-2026:2224 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jul 29, 2026
- RHSA-2026:2225 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Jul 29, 2026
- SUSE-SU-2026:20912-1 Security update for keylime SUSE / openSUSE Security Updates · Apr 2, 2026
- WID-SEC-2026-0339 Red Hat Enterprise Linux (Keylime): Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Apr 1, 2026
- openSUSE-SU-2026:20398-1 Security update for keylime SUSE / openSUSE Security Updates · Mar 29, 2026
- openSUSE-SU-2026:10165-1 keylime-config-7.14.0+0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2026:2224 Critical: keylime security update Rocky Linux Security Advisories · Feb 13, 2026
- RLSA-2026:2225 Critical: keylime security update Rocky Linux Security Advisories · Feb 11, 2026
- ELSA-2026-2225 Critical: keylime security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Feb 9, 2026
- ELSA-2026-2224 Critical: keylime security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 9, 2026
References
- RHSA-2026:2224 vendor-advisory
- RHSA-2026:2225 vendor-advisory
- RHSA-2026:2298 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1709 vdb-entry
- RHBZ#2435514 issue-tracking