CVE-2026-1709 — Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls au…

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

GHSA-4jqp-9qjv-57m2 — Keylime Missing Authentication for Critical Function and Improper Authentication

Affected: PyPI: keylime

### Impact

The Keylime registrar does not enforce mutual TLS (mTLS) client certificate authentication since version 7.12.0. The registrar's TLS context is configured with `ssl.CERT_OPTIONAL` instead of `ssl.CERT_REQUIRED`, allowing any client to connect to protected API endpoints without presenting a valid client certificate.

**Who is impacted:** - All Keylime deployments running versions 7.12.0 through 7.13.0 - Environments where the registrar HTTPS port (default 8891) is network-accessible to untrusted clients

**What an attacker can do:** - **List all registered agents** (`GET /v2/agents/`) - enumerate the entire agent inventory - **Retrieve agent details** (`GET /v2/agents/{uuid}`) - obtain public TPM keys, certificates, and network locations (IP/port) of any agent - **Delete any agent** (`DELETE /v2/agents/{uuid}`) - remove agents from the registry, disrupting attestation services

Note: The exposed TPM data (EK, AK, certificates) consists of public keys and certificates. Private keys remain protected within TPM hardware. The HMAC secret used for challenge-response validation is stored in the database but is not exposed via the API.

**Affected versions:** >= 7.12.0, <= 7.13.0

**Fixed versions:** 7.12.2, >= 7.13.1

### Patches

A patch for the affected released versions is available. It removes the line that override the configuration of `ssl.verify_mode`, leaving the `CERT_REQUIRED` value set by `web_util.init_mtls()`:

```diff diff --git a/keylime/web/bas…

Most recent entries from all

CVE-2026-1709 — Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls au…

GHSA-4jqp-9qjv-57m2 — Keylime Missing Authentication for Critical Function and Improper Authentication