{"id":"CVE-2026-1709","aliases":["ALSA-2026:2224","ALSA-2026:2225","EUVD-2026-5599","GHSA-4jqp-9qjv-57m2","PYSEC-2026-74","RHSA-2026:2224","RHSA-2026:2225","RHSA-2026:2298","RLSA-2026:2224","RLSA-2026:2225","SUSE-SU-2026:20912-1","openSUSE-SU-2026:10165-1","openSUSE-SU-2026:20398-1"],"status":"published","title":"Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication","description":"A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0571,"percentile":0.93079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-306","CWE-322"],"published":"2026-02-06T19:13:27Z","modified":"2026-10-29T11:32:33Z","fixes":[{"ecosystem":"PyPI","package":"keylime","fixed_in":["7.12.2","7.13.1","7.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"keylime","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"keylime-base","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"keylime-registrar","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"keylime-selinux","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"keylime-tenant","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"keylime-verifier","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-keylime","fixed_in":["7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-selinux","fixed_in":["7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-base","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-registrar","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-selinux","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-tenant","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-verifier","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-keylime","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-base","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-registrar","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-selinux","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-tenant","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-tools","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-verifier","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-keylime","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-base","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-registrar","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-selinux","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-tenant","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-tools","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-verifier","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-keylime","fixed_in":["0:7.12.1-2.el10_0.5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"keylime","fixed_in":["0:7.12.1-11.el9_7.4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"keylime","fixed_in":["0:7.12.1-11.el10_1.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"keylime","fixed_in":["7.14.0+0-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"keylime","fixed_in":["7.14.0+0-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"keylime","fixed_in":["7.14.0+0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"keylime","fixed_in":["7.14.0+0-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"7.12.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.0"},{"last_affected":"7.13.0"},{"fixed":"7.13.1"}]}],"versions":["7.13.0"]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"7.12.2"}]}],"versions":["7.12.0","7.12.1"]},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.0"},{"fixed":"7.13.1"}]}],"versions":["7.13.0"]},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0"}]}],"versions":["6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.4.3","6.5.0","6.5.1","6.5.2","6.5.3","6.6.0","6.8.0","7.0.0","7.10.0","7.2.5","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0","7.9.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-2.el10_0.5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el9_7.4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.el10_1.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.0+0-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.0+0-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.0+0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.0+0-160000.1.1"}]}]}],"products":[{"vendor":"keylime","product":"keylime"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64_eus"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:2224","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2225","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2298","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1709","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2435514","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1709.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://github.com/keylime/keylime/security/advisories/GHSA-4jqp-9qjv-57m2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1709","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2026-74.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4jqp-9qjv-57m2","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2435514","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-2224.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-2225.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1709.json","tags":["advisory"]},{"url":"https://github.com/keylime/keylime","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2224.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1709","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2225.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2298.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2224","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2225","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620912-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257895","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1709","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-1709","title":"Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication","description":"A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.","status":"published","published":"2026-02-06T19:13:27.695Z","modified":"2026-07-15T01:21:13.546Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-322","CWE-322"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-5599","description":"A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.","status":"published","published":"2026-02-06T19:13:27Z","modified":"2026-07-15T01:21:13Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-4jqp-9qjv-57m2","title":"Keylime Missing Authentication for Critical Function and Improper Authentication","description":"### Impact\n\nThe Keylime registrar does not enforce mutual TLS (mTLS) client certificate authentication since version 7.12.0. The registrar's TLS context is configured with `ssl.CERT_OPTIONAL` instead of `ssl.CERT_REQUIRED`, allowing any client to connect to protected API endpoints without presenting a valid client certificate.\n\n**Who is impacted:**\n  - All Keylime deployments running versions 7.12.0 through 7.13.0\n  - Environments where the registrar HTTPS port (default 8891) is network-accessible to untrusted clients\n\n**What an attacker can do:**\n  - **List all registered agents** (`GET /v2/agents/`) - enumerate the entire agent inventory\n  - **Retrieve agent details** (`GET /v2/agents/{uuid}`) - obtain public TPM keys, certificates, and network locations (IP/port) of any agent\n  - **Delete any agent** (`DELETE /v2/agents/{uuid}`) - remove agents from the registry, disrupting attestation services\n\nNote: The exposed TPM data (EK, AK, certificates) consists of public keys and certificates. Private keys remain protected within TPM hardware. The HMAC secret used for challenge-response validation is stored in the database but is not exposed via the API.\n\n**Affected versions:** \u003e= 7.12.0, \u003c= 7.13.0\n\n**Fixed versions:** 7.12.2, \u003e= 7.13.1\n\n### Patches\n\nA patch for the affected released versions is available. It removes the line that override the configuration of `ssl.verify_mode`, leaving the `CERT_REQUIRED` value set by `web_util.init_mtls()`:\n\n```diff\ndiff --git a/keylime/web/base/server.py b/keylime/web/base/server.py\nindex 1d9a9c2..859b23a 100644\n--- a/keylime/web/base/server.py\n+++ b/keylime/web/base/server.py\n@@ -2,7 +2,6 @@ import asyncio\n import multiprocessing\n from abc import ABC, abstractmethod\n from functools import wraps\n-from ssl import CERT_OPTIONAL\n from typing import TYPE_CHECKING, Any, Callable, Optional\n\n import tornado\n@@ -252,7 +251,6 @@ class Server(ABC):\n         self._https_port = config.getint(component, \"tls_port\", fallback=0)\n         self._max_upload_size = config.getint(component, \"max_upload_size\", fallback=104857600)\n         self._ssl_ctx = web_util.init_mtls(component)\n-        self._ssl_ctx.verify_mode = CERT_OPTIONAL\n\n     def _get(self, pattern: str, controller: type[\"Controller\"], action: str, allow_insecure: bool = False) -\u003e None:\n         \"\"\"Creates a new route to handle incoming GET requests issued for paths which match the given\n```\n\nUsers should upgrade to the patched version once it is released.\n\n### Workarounds\n\nIf upgrading is not immediately possible, apply one of the following mitigations:\n\n#### 1. Network isolation (Recommended)\n\nRestrict access to the registrar HTTPS port (default 8891) using firewall rules\nto allow only trusted hosts (verifier, tenant):\n\n##### Example using iptables\n```\niptables -A INPUT -p tcp --dport 8891 -s \u003cverifier_ip\u003e -j ACCEPT\niptables -A INPUT -p tcp --dport 8891 -s \u003ctenant_ip\u003e -j ACCEPT\niptables -A INPUT -p tcp --dport 8891 -j DROP\n```\n\n#### 2. Reverse proxy with mTLS enforcement\n\nDeploy a reverse proxy (nginx, HAProxy) in front of the registrar that enforces client certificate authentication:\n\n##### Example nginx configuration\n```\nserver {\n    listen 8891 ssl;\n    ssl_certificate /path/to/server.crt;\n    ssl_certificate_key /path/to/server.key;\n    ssl_client_certificate /path/to/ca.crt;\n    ssl_verify_client on;  # Enforce client certificates\n\n    location / {\n        proxy_pass https://localhost:8892;  # Internal registrar port\n    }\n}\n```","status":"published","published":"2026-02-06T22:34:44Z","modified":"2026-06-06T00:37:10Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-295","CWE-306"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2026-1709","description":"A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.","status":"published","published":"2026-02-06T20:16:09.193Z","modified":"2026-07-15T02:18:19.833Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"CVE-2026-1709","title":"Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication","description":"A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.","status":"published","published":"2026-02-06T19:13:27.695Z","modified":"2026-10-28T02:30:22.8485768Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"GHSA-4jqp-9qjv-57m2","title":"Keylime Missing Authentication for Critical Function and Improper Authentication","description":"### Impact\n\nThe Keylime registrar does not enforce mutual TLS (mTLS) client certificate authentication since version 7.12.0. The registrar's TLS context is configured with `ssl.CERT_OPTIONAL` instead of `ssl.CERT_REQUIRED`, allowing any client to connect to protected API endpoints without presenting a valid client certificate.\n\n**Who is impacted:**\n  - All Keylime deployments running versions 7.12.0 through 7.13.0\n  - Environments where the registrar HTTPS port (default 8891) is network-accessible to untrusted clients\n\n**What an attacker can do:**\n  - **List all registered agents** (`GET /v2/agents/`) - enumerate the entire agent inventory\n  - **Retrieve agent details** (`GET /v2/agents/{uuid}`) - obtain public TPM keys, certificates, and network locations (IP/port) of any agent\n  - **Delete any agent** (`DELETE /v2/agents/{uuid}`) - remove agents from the registry, disrupting attestation services\n\nNote: The exposed TPM data (EK, AK, certificates) consists of public keys and certificates. Private keys remain protected within TPM hardware. The HMAC secret used for challenge-response validation is stored in the database but is not exposed via the API.\n\n**Affected versions:** \u003e= 7.12.0, \u003c= 7.13.0\n\n**Fixed versions:** 7.12.2, \u003e= 7.13.1\n\n### Patches\n\nA patch for the affected released versions is available. It removes the line that override the configuration of `ssl.verify_mode`, leaving the `CERT_REQUIRED` value set by `web_util.init_mtls()`:\n\n```diff\ndiff --git a/keylime/web/base/server.py b/keylime/web/base/server.py\nindex 1d9a9c2..859b23a 100644\n--- a/keylime/web/base/server.py\n+++ b/keylime/web/base/server.py\n@@ -2,7 +2,6 @@ import asyncio\n import multiprocessing\n from abc import ABC, abstractmethod\n from functools import wraps\n-from ssl import CERT_OPTIONAL\n from typing import TYPE_CHECKING, Any, Callable, Optional\n\n import tornado\n@@ -252,7 +251,6 @@ class Server(ABC):\n         self._https_port = config.getint(component, \"tls_port\", fallback=0)\n         self._max_upload_size = config.getint(component, \"max_upload_size\", fallback=104857600)\n         self._ssl_ctx = web_util.init_mtls(component)\n-        self._ssl_ctx.verify_mode = CERT_OPTIONAL\n\n     def _get(self, pattern: str, controller: type[\"Controller\"], action: str, allow_insecure: bool = False) -\u003e None:\n         \"\"\"Creates a new route to handle incoming GET requests issued for paths which match the given\n```\n\nUsers should upgrade to the patched version once it is released.\n\n### Workarounds\n\nIf upgrading is not immediately possible, apply one of the following mitigations:\n\n#### 1. Network isolation (Recommended)\n\nRestrict access to the registrar HTTPS port (default 8891) using firewall rules\nto allow only trusted hosts (verifier, tenant):\n\n##### Example using iptables\n```\niptables -A INPUT -p tcp --dport 8891 -s \u003cverifier_ip\u003e -j ACCEPT\niptables -A INPUT -p tcp --dport 8891 -s \u003ctenant_ip\u003e -j ACCEPT\niptables -A INPUT -p tcp --dport 8891 -j DROP\n```\n\n#### 2. Reverse proxy with mTLS enforcement\n\nDeploy a reverse proxy (nginx, HAProxy) in front of the registrar that enforces client certificate authentication:\n\n##### Example nginx configuration\n```\nserver {\n    listen 8891 ssl;\n    ssl_certificate /path/to/server.crt;\n    ssl_certificate_key /path/to/server.key;\n    ssl_client_certificate /path/to/ca.crt;\n    ssl_verify_client on;  # Enforce client certificates\n\n    location / {\n        proxy_pass https://localhost:8892;  # Internal registrar port\n    }\n}\n```","status":"published","published":"2026-02-06T22:34:44Z","modified":"2026-06-06T00:45:49.404160714Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"cwes":["CWE-295","CWE-306"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"PYSEC-2026-74","description":"A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.","status":"published","published":"2026-02-06T20:16:09.193Z","modified":"2026-06-10T17:01:56.825950085Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2026:2224","title":"Red Hat Security Advisory: keylime security update","status":"published","published":"2026-02-09T10:05:41Z","modified":"2026-07-29T10:06:05Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:2225","title":"Red Hat Security Advisory: keylime security update","status":"published","published":"2026-02-09T10:05:41Z","modified":"2026-07-29T10:06:05Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:2298","title":"Red Hat Security Advisory: keylime security update","status":"published","published":"2026-02-09T10:05:50Z","modified":"2026-07-29T10:06:21Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:2224","title":"Critical: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.\n\nSecurity Fix(es):\n\n* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-13T09:06:49.393244Z","modified":"2026-02-13T09:30:21.797845Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:2225","title":"Critical: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.\n\nSecurity Fix(es):\n\n* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-11T09:16:03.960464Z","modified":"2026-02-11T09:45:16.138245Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ALSA-2026:2224","title":"Critical: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.  \n\nSecurity Fix(es):  \n\n  * keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-09T00:00:00Z","modified":"2026-10-29T11:32:33.966943451Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:2225","title":"Critical: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.  \n\nSecurity Fix(es):  \n\n  * keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-09T00:00:00Z","modified":"2026-10-29T11:30:26.416687186Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"openSUSE-SU-2026:10165-1","title":"keylime-config-7.14.0+0-1.1 on GA media","description":"These are all security issues fixed in the keylime-config-7.14.0+0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:31.523264Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20398-1","title":"Security update for keylime","description":"This update for keylime fixes the following issues:\n\n- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):\n- CVE-2026-1709: Fixed an authentication bypass which may allow unauthorized administrative operations due to missing client-side TLS authentication. (bsc#1257895)\n","status":"published","published":"2026-03-19T08:16:55Z","modified":"2026-03-29T17:24:43.184244Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:20912-1","title":"Security update for keylime","description":"This update for keylime fixes the following issues:\n\n- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):\n- CVE-2026-1709: Fixed an authentication bypass which may allow unauthorized administrative operations due to missing client-side TLS authentication. (bsc#1257895)\n","status":"published","published":"2026-03-19T08:18:07Z","modified":"2026-04-02T17:33:50.287901Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}