CVE-2026-1709
CRITICALPypi Keylime < 7.12.2 - Authentication Bypass
Title source: ruleDescription
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
References (5)
Scores
CVSS v3
9.4
EPSS
0.0003
EPSS Percentile
9.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Classification
CWE
CWE-322
Status
published
Affected Products (14)
pypi/keylime
< 7.12.2PyPI
keylime/keylime
< 7.12.0
redhat/enterprise_linux
redhat/enterprise_linux
redhat/enterprise_linux_eus
redhat/enterprise_linux_for_arm_64
redhat/enterprise_linux_for_arm_64
redhat/enterprise_linux_for_arm_64_eus
redhat/enterprise_linux_for_ibm_z_systems
redhat/enterprise_linux_for_ibm_z_systems
redhat/enterprise_linux_for_ibm_z_systems_eus
redhat/enterprise_linux_for_power_little_endian
redhat/enterprise_linux_for_power_little_endian
redhat/enterprise_linux_for_power_little_endian_eus
Timeline
Published
Feb 06, 2026
Tracked Since
Feb 18, 2026