Description
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keylime | 7.14.0 – < 7.14.2 | 7.14.2 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | keylime +7 | 7.14.1-5.el10_2.1 | RHSA-2026:28582 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | keylime +7 | 7.14.1-5.el10_2.1 | ALSA-2026:28582 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | keylime | 7.14.1-5.el10_2.1 | RLSA-2026:28582 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | keylime | 7.14.2-160000.1.1 | SUSE-SU-2026:22326-1 |
| SLES 16.0 | keylime | 7.14.2-160000.1.1 | SUSE-SU-2026:22326-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | keylime | 7.14.2-1.1 | openSUSE-SU-2026:10779-1 |
| openSUSE Leap 16.0 | keylime | 7.14.2-160000.1.1 | openSUSE-SU-2026:21025-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | keylime +7 | 7.14.1-5.el10_2.1 | ELSA-2026-28582 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keylime | >= 7.14.0, < 7.14.2 | 7.14.2 | GHSA-q8w6-w55c-ccv5 |
Advisories 8
- ALSA-2026:28582 Moderate: keylime security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:28582 Red Hat Security Advisory: keylime security update Red Hat Security Advisories (RHSA) · Oct 3, 2026
- WID-SEC-2026-2049 Red Hat Enterprise Linux (keylime): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 16, 2026
- ELSA-2026-28582 Moderate: keylime security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- SUSE-SU-2026:22326-1 Security update for keylime SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21025-1 Security update for keylime SUSE / openSUSE Security Updates · Jun 30, 2026
- RLSA-2026:28582 Moderate: keylime security update Rocky Linux Security Advisories · Jun 25, 2026
- openSUSE-SU-2026:10779-1 keylime-config-7.14.2-1.1 on GA media SUSE / openSUSE Security Updates · May 15, 2026
References
- RHSA-2026:28582 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-6420 vdb-entry
- RHBZ#2458889 issue-tracking