CVE-2026-1709
CriticalCVSS 9.4Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A flaw was found in Keylime since version 7.12.0 where the registrar does not enforce client-side TLS authentication. Unauthenticated clients with network access can perform administrative operations, including listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate.
Risk Assessment
The risk involves unauthorized access to sensitive TPM data and agent manipulation, potentially compromising the integrity and confidentiality of the trust infrastructure.
Recommendation
Immediately update Keylime to a version that enforces client-side TLS authentication, or temporarily restrict network access to the registrar.
Other vulnerabilities in Keylime
See all- CVE-2025-13609High
A vulnerability in Keylime allows an attacker to register a new agent using a different TPM device but claiming an existing agent's UUID. This overwrites the legitimate agent's identity and enables impersonation.
- CVE-2025-1057Medium
In Keylime 7.12.0, strict type checking prevents the registrar from reading database entries created by older versions (e.g., 7.11.0). Older versions store agent registration data as bytes, while the updated registrar expects str. This causes an exception when processing agent registration requests, making the agent fail.
- CVE-2023-38200High
A flaw was found in Keylime that allows for a remote denial of service attack against its SSL connections. An attacker can exhaust all available connections.
Original NVD description (English source)
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS