Critical Authentication Bypass Vulnerability in Keylime Package
Summary
ALSA-2026:2225: Critical: keylime security update. Affects keylime versions < 7.12.1-11.el10_1.4. Fixed in 7.12.1-11.el10_1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keylime is a TPM (Trusted Platform Module) based solution designed for scalable remote boot attestation and runtime integrity measurement. It provides a framework for ensuring that systems boot securely and maintain their integrity throughout their runtime. The package is widely used in environments where security and trust are paramount, making its integrity essential. However, it has been found to have a critical vulnerability that could allow unauthorized administrative operations.
Vulnerability Detail
The vulnerability arises from a missing client-side TLS authentication in Keylime, which leads to an authentication bypass. This flaw allows attackers to perform unauthorized administrative operations, potentially compromising the integrity and security of the system. The issue is identified as CVE-2026-1709, and it poses significant risks to environments relying on Keylime for secure operations.
How To Fix
Minimum fixed version
7.12.1-11.el10_1.4
This is the first release that contains the fix.
sudo dnf update keylimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional network security measures to restrict access to the Keylime services, ensuring that only trusted clients can communicate with the server. However, this is not a substitute for applying the patch.
Conclusion
The Keylime package has a critical vulnerability that allows unauthorized administrative operations due to a missing client-side TLS authentication. It is crucial for users to update to the patched version to mitigate risks. Temporary workarounds can provide limited protection, but applying the patch is the best course of action.
See every vulnerability recorded for keylime →
FAQ
The vulnerability is an authentication bypass due to missing client-side TLS authentication, allowing unauthorized administrative access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could lead to unauthorized administrative operations, compromising the security and integrity of systems using Keylime.
Yes, a patch is available. Users should update to version 7.12.1-11.el10_1.4 or later.
Implement network security measures to restrict access to Keylime services until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
