PYSEC-2026-74
At a glance
- Published
- Updated
- CVE
- CVE-2026-1709
- Aliases
- GHSA-4jqp-9qjv-57m2
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Affected packages
| Package | Versions |
|---|---|
| PyPI · keylime | introduced 0, fixed 7.12.0 |
References
- https://access.redhat.com/errata/RHSA-2026:2224 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:2225 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:2298 ADVISORY
- https://access.redhat.com/security/cve/CVE-2026-1709 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2435514 REPORT
- https://github.com/advisories/GHSA-4jqp-9qjv-57m2 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |