CVE-2026-1709
Critical · 9.4CVSS
9.4
EPSS
5.8%
Published
Feb 6, 2026
CISA due date
—
The record
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | keylime | 7.12.0 | 7.12.2 |
| PyPI | keylime | 7.13.0 | 7.13.1 |
| openSUSE:Leap 16.0 | keylime | 0 | 7.14.0+0-160000.1.1 |
| openSUSE:Tumbleweed | keylime | 0 | 7.14.0+0-1.1 |
Related vulnerabilities
- GHSA-4jqp-9qjv-57m2 Keylime Missing Authentication for Critical Function and Improper Authentication Same vulnerability
- GHSA-27jc-jmp8-qfw5 Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper… Also affects keylime
- GHSA-xh5w-g8gq-r3v9 Keylime allows users to register new agents by recycling existing UUIDs when using… Also affects keylime
- CVE-2025-13609 A vulnerability has been identified in keylime where an attacker can exploit this flaw by… Also affects keylime
- CVE-2026-6420 A flaw was found in Keylime. Also affects keylime