Critical Authentication Bypass in Keylime Package
Summary
GHSA-27jc-jmp8-qfw5: Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication. Affects keylime across 2 version ranges.
>= 7.12.0, < 7.12.2
>= 7.13.0, < 7.13.1
Fixed in 7.12.2 or 7.13.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is an open-source project that provides a framework for remote attestation of trusted computing devices. It enables secure management of Trusted Platform Modules (TPMs) and ensures that only trusted devices can access sensitive operations. However, a critical vulnerability has been identified in versions 7.12.0 and 7.13.0, where the Keylime registrar fails to enforce client-side Transport Layer Security (TLS) authentication, exposing it to potential unauthorized access.
Vulnerability Detail
The vulnerability arises from the Keylime registrar's lack of enforcement for client-side TLS authentication, which was introduced in version 7.12.0. This flaw allows unauthenticated clients with network access to perform administrative operations, such as listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate. The ramifications of this vulnerability are severe, as it could lead to unauthorized access and manipulation of sensitive data and operations within the Keylime framework.
How To Fix
Latest published version: 7.14.3 as of 22 Oct 2026
pip install --upgrade "keylime==7.14.3"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.12.0, < 7.12.27.12.2pip install --upgrade "keylime==7.12.2" -
>= 7.13.0, < 7.13.17.13.1pip install --upgrade "keylime==7.13.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict network access to the Keylime registrar to trusted clients only, thereby minimizing the risk of unauthorized access until the package is updated. However, this is not a permanent solution and should not replace the need for an update.
Conclusion
The Keylime package has a critical vulnerability that allows unauthorized access due to the lack of client-side TLS authentication enforcement. It is crucial to update to the patched versions to secure your application against potential threats. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for keylime →
FAQ
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
Versions 7.12.0 and 7.13.0 of Keylime are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Unauthorized clients can perform administrative operations such as listing agents, retrieving public TPM data, and deleting agents.
Yes, you can restrict network access to the Keylime registrar to trusted clients only as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
