CRITICAL🇵🇱 Wersja polska

CVE-2026-1709

CVSS 9.4v3.1pub. 2026-02-06upd. 2026-06-27

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Keylime
APP
Keylime
< 7.12.0
Red Hat Enterprise Linux
OS
Redhat
10.09.0
Red Hat Enterprise Linux Eus
OS
Redhat
10.0
Red Hat Enterprise Linux For Arm 64
OS
Redhat
10.0_aarch649.0_aarch64
Red Hat Enterprise Linux For Arm 64 Eus
OS
Redhat
10.0_aarch64
Red Hat Enterprise Linux For IBM Z Systems
OS
Redhat
10.0_s390x9.0_s390x
Red Hat Enterprise Linux For IBM Z Systems Eus
OS
Redhat
10.0_s390x
Red Hat Enterprise Linux For Power Little Endian
OS
Redhat
10.0_ppc64le9.0_ppc64le
Red Hat Enterprise Linux For Power Little Endian Eus
OS
Redhat
10.0_ppc64le