CVE-2026-1709: Keylime Critical Authentication Bypass Vulnerability

Background

Keylime is an open-source project that provides a framework for remote attestation of trusted computing systems. It enables secure communication between a verifier and a tenant, ensuring that only trusted agents are allowed to participate in the attestation process. The vulnerability in question arises from a misconfiguration in the mutual TLS (mTLS) authentication mechanism, which is critical for securing communications between clients and the Keylime registrar.

Vulnerability Detail

The Keylime registrar, starting from version 7.12.0, fails to enforce mutual TLS (mTLS) client certificate authentication due to its TLS context being set to 'ssl.CERT_OPTIONAL' instead of 'ssl.CERT_REQUIRED'. This misconfiguration allows any client to connect to sensitive API endpoints without presenting a valid client certificate. As a result, an attacker can list all registered agents, retrieve sensitive agent details, and delete agents from the registry, potentially disrupting attestation services and exposing public TPM data.

pip install --upgrade "keylime==7.14.3"

Workaround

text

If immediate upgrading is not feasible, consider implementing one of the following workarounds:

1. Network Isolation: Restrict access to the registrar's HTTPS port (default 8891) using firewall rules to allow only trusted hosts. Example using iptables:

iptables -A INPUT -p tcp --dport 8891 -s <verifier_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 8891 -s <tenant_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 8891 -j DROP

2. Reverse Proxy with mTLS Enforcement: Deploy a reverse proxy (e.g., nginx) that enforces client certificate authentication. Example nginx configuration:

server {
    listen 8891 ssl;
    ssl_certificate /path/to/server.crt;
    ssl_certificate_key /path/to/server.key;
    ssl_client_certificate /path/to/ca.crt;
    ssl_verify_client on;  # Enforce client certificates

    location / {
        proxy_pass https://localhost:8892;  # Internal registrar port
    }
}

Conclusion

CVE-2026-1709 is a critical vulnerability in Keylime that allows unauthorized access to sensitive API endpoints due to improper authentication settings. Users are strongly advised to upgrade to the patched versions or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.

See every vulnerability recorded for keylime →

FAQ