CVE-2026-1709
published 2026-02-06CVE-2026-1709: A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This…
PriorityP278critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.43%
91.8th percentile
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keylime | keylime | < 7.12.0 | 7.12.0 |
| keylime | keylime | >= 7.12.0 < 7.12.2 | 7.12.2 |
| keylime | keylime | >= 7.13.0 < 7.13.1 | 7.13.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_for_arm_64 | — | — |
| redhat | enterprise_linux_for_arm_64 | — | — |
| redhat | enterprise_linux_for_arm_64_eus | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_eus | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian_eus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated (no client certificate) HTTPS connections to the Keylime registrar port 8891. Legitimate clients should always present a client certificate; connections without one are indicative of exploitation attempts. ↗
- →Flag any HTTP requests to the Keylime registrar (port 8891) originating from hosts that are not the trusted verifier or tenant — especially standard HTTP clients such as curl or wget, which require no credentials or special tooling to exploit this vulnerability. ↗
- →Audit Keylime registrar TLS context configuration for the absence of ssl.CERT_REQUIRED. Its absence on versions >= 7.12.0 confirms the vulnerable configuration. ↗
- →Monitor administrative operations against the Keylime registrar (agent listing, agent deletion, TPM data retrieval) for requests that lack a mutual TLS client certificate, particularly on Keylime versions 7.12.0 and later. ↗
- ·Only Keylime versions 7.12.0 and later are vulnerable. RHEL 9.6 and earlier shipped packages are NOT affected as they never included the vulnerable version. ↗
- ·The vulnerability requires direct network access to the registrar's HTTPS port (default 8891). Restricting access to this port via firewall rules to only trusted verifier and tenant hosts is an effective mitigation until patching. ↗
- ·The fix (adding ssl.CERT_REQUIRED) is present in keylime-7.14.1 and later. Verify the installed version to confirm whether the patch has been applied. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Keylime Missing Authentication for Critical Function and Improper Authentication
osv·2026-02-06
CVE-2026-1709 [CRITICAL] Keylime Missing Authentication for Critical Function and Improper Authentication
Keylime Missing Authentication for Critical Function and Improper Authentication
### Impact
The Keylime registrar does not enforce mutual TLS (mTLS) client certificate authentication since version 7.12.0. The registrar's TLS context is configured with `ssl.CERT_OPTIONAL` instead of `ssl.CERT_REQUIRED`, allowing any client to connect to protected API endpoints without presenting a valid client certificate.
**Who is impacted:**
- All Keylime deployments running versions 7.12.0 through 7.13.0
- Environments where the registrar HTTPS port (default 8891) is network-accessible to untrusted clients
**What an attacker can do:**
- **List all registered agents** (`GET /v2/agents/`) - enumerate the entire agent inventory
- **Retrieve agent details** (`GET /v2/agents/{uuid}`) - obtain public TPM k
GHSA
Keylime Missing Authentication for Critical Function and Improper Authentication
ghsa·2026-02-06
CVE-2026-1709 [CRITICAL] CWE-295 Keylime Missing Authentication for Critical Function and Improper Authentication
Keylime Missing Authentication for Critical Function and Improper Authentication
### Impact
The Keylime registrar does not enforce mutual TLS (mTLS) client certificate authentication since version 7.12.0. The registrar's TLS context is configured with `ssl.CERT_OPTIONAL` instead of `ssl.CERT_REQUIRED`, allowing any client to connect to protected API endpoints without presenting a valid client certificate.
**Who is impacted:**
- All Keylime deployments running versions 7.12.0 through 7.13.0
- Environments where the registrar HTTPS port (default 8891) is network-accessible to untrusted clients
**What an attacker can do:**
- **List all registered agents** (`GET /v2/agents/`) - enumerate the entire agent inventory
- **Retrieve agent details** (`GET /v2/agents/{uuid}`) - obtain public TPM k
Red Hat
keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
vendor_redhat·2026-02-06·CVSS 9.4
CVE-2026-1709 [CRITICAL] CWE-322 keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with net
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-1709 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.4
CVE-2026-1709 [CRITICAL] CVE-2026-1709 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1709 :
Python vulnerability analysis and mitigation
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Source : NVD
## 9.8
Score
Published February 6, 2026
Severity CRITICAL
CNA Score 9.4
Affected Technologies
Python
Rocky Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 11.3
Exploitation
Bugzilla
CVE-2026-48683 fastnetmon: FastNetMon: Information disclosure or Denial of Service via out-of-bounds read in NetFlow v9 processing
bugzilla·2026-05-26·CVSS 6.5
CVE-2026-48683 [MEDIUM] CVE-2026-48683 fastnetmon: FastNetMon: Information disclosure or Denial of Service via out-of-bounds read in NetFlow v9 processing
CVE-2026-48683 fastnetmon: FastNetMon: Information disclosure or Denial of Service via out-of-bounds read in NetFlow v9 processing
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow_v9_collector.cpp, the Data template branch (lines 1695-1702) iterates over flow records without performing a per-iteration bounds check against the packet end pointer. In contrast, the Options template branch (lines 1709-1719) correctly checks 'if (pkt + offset + field_template->total_length > packet_end)' before each iteration. The Data branch omits this check entirely. Since template definitions are sent by the network peer (and are unauthenticated UDP), an attacker can craft templates that cause the
Bugzilla
CVE-2026-1709 keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
bugzilla·2026-01-30·CVSS 9.8
CVE-2026-1709 [CRITICAL] CVE-2026-1709 keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
CVE-2026-1709 keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
The Keylime registrar since version 7.12.0 does not require client-side TLS authentication because ssl.CERT_REQUIRED is not set when configuring the TLS context. This allows unauthenticated clients to perform administrative operations (list agents, retrieve public TPM data, delete agents) by connecting without presenting a client certificate.
Requirements to exploit:
* Network access to the registrar HTTPS port (default 8891)
* No credentials, certificates, or special tools required
* Standard HTTP client (curl, wget, etc.) is sufficient
Mitigation if available:
1. Network isolation - Restrict network access to registrar port 8891 to only tru
https://access.redhat.com/errata/RHSA-2026:2224https://access.redhat.com/errata/RHSA-2026:2225https://access.redhat.com/errata/RHSA-2026:2298https://access.redhat.com/security/cve/CVE-2026-1709https://bugzilla.redhat.com/show_bug.cgi?id=2435514https://access.redhat.com/errata/RHSA-2026:2224https://access.redhat.com/errata/RHSA-2026:2225https://access.redhat.com/errata/RHSA-2026:2298https://access.redhat.com/security/cve/CVE-2026-1709https://bugzilla.redhat.com/show_bug.cgi?id=2435514https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1709.json
2026-02-06
Published