CVE-2025-13609
High · 8.2CVSS
8.2
EPSS
0.4%
Published
Nov 24, 2025
CISA due date
—
The record
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | keylime | 0 | 7.13.0 |
| AlmaLinux:10 | keylime | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | keylime-base | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | keylime-registrar | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | keylime-selinux | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | keylime-tenant | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | keylime-tools | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | keylime-verifier | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:10 | python3-keylime | 0 | 7.12.1-11.el10_1.3 |
| AlmaLinux:9 | keylime | 0 | 7.12.1-11.el9_7.3 |
| AlmaLinux:9 | keylime-base | 0 | 7.12.1-11.el9_7.3 |
| AlmaLinux:9 | keylime-registrar | 0 | 7.12.1-11.el9_7.3 |
| AlmaLinux:9 | keylime-selinux | 0 | 7.12.1-11.el9_7.3 |
| AlmaLinux:9 | keylime-tenant | 0 | 7.12.1-11.el9_7.3 |
| AlmaLinux:9 | keylime-verifier | 0 | 7.12.1-11.el9_7.3 |
| AlmaLinux:9 | python3-keylime | 0 | 7.12.1-11.el9_7.3 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | keylime | 0 | 6.3.2-150400.4.23.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | keylime | 0 | 6.3.2-150400.4.23.1 |
| openSUSE:Leap 15.6 | keylime | 0 | 6.3.2-150400.4.23.1 |
| openSUSE:Leap 16.0 | keylime | 0 | 7.13.0+40-160000.1.1 |
| openSUSE:Tumbleweed | keylime | 0 | 7.13.0+40-1.1 |
Related vulnerabilities
- GHSA-xh5w-g8gq-r3v9 Keylime allows users to register new agents by recycling existing UUIDs when using… Same vulnerability
- GHSA-4jqp-9qjv-57m2 Keylime Missing Authentication for Critical Function and Improper Authentication Also affects keylime
- GHSA-27jc-jmp8-qfw5 Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper… Also affects keylime
- CVE-2026-1709 A flaw was found in Keylime. Also affects keylime
- CVE-2026-6420 A flaw was found in Keylime. Also affects keylime
- CVE-2026-5794 A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to… CWE-694
- CVE-2025-59048 OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method CWE-694