A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-selinuxUpgrade keylime-baseUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-registrarUpgrade keylimeUpgrade keylime-verifier | Feb 13, 2026 | Feb 9, 2026 |
| Oracle_linux | — | Upgrade keylime-selinuxUpgrade keylimeUpgrade keylime-tenantUpgrade keylime-toolsUpgrade keylime-registrarUpgrade keylime-baseUpgrade python3-keylimeUpgrade keylime-verifier | Feb 11, 2026 | Feb 6, 2026 |
| Redhat_linux | — | Upgrade keylimeUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-verifierUpgrade python3-keylimeUpgrade keylime-selinuxUpgrade keylime-toolsUpgrade keylime-tenant | Feb 10, 2026 | Feb 6, 2026 |
| Rocky_linux | — | Upgrade keylime-baseUpgrade keylime-registrarUpgrade keylime-toolsUpgrade keylime-verifierUpgrade keylimeUpgrade keylime-tenantUpgrade python3-keylime | Feb 13, 2026 | Feb 11, 2026 |
| Suse | — | Upgrade keylime-configUpgrade python313-keylimeUpgrade keylime-registrarUpgrade keylime-logrotateUpgrade keylime-tpm_cert_storeUpgrade keylime-firewalldUpgrade keylime-tenantUpgrade keylime-verifier | Mar 27, 2026 | Mar 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub