CVE-2026-1709
CriticalCVSS 9.4Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A flaw was found in Keylime since version 7.12.0 where the registrar does not enforce client-side TLS authentication. Unauthenticated clients with network access can perform administrative operations, including listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate.
Risk Assessment
The risk involves unauthorized access to sensitive TPM data and agent manipulation, potentially compromising the integrity and confidentiality of the trust infrastructure.
Recommendation
Immediately update Keylime to a version that enforces client-side TLS authentication, or temporarily restrict network access to the registrar.
Original NVD description (English source)
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.