Keylime Security Update: Vulnerability in Keylime Packages
Summary
ALSA-2026:28582: Moderate: keylime security update. Affects keylime versions < 7.14.1-5.el10_2.1. Fixed in 7.14.1-5.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is a TPM-based solution designed for highly scalable remote boot attestation and runtime integrity measurement. It provides a framework for ensuring the integrity of systems by verifying the state of the software and hardware components. The recent vulnerability affects multiple Keylime packages within the AlmaLinux ecosystem, which are critical for maintaining secure operations in environments relying on trusted computing.
Vulnerability Detail
The vulnerability identified as CVE-2026-6420 is a security bypass caused by a hardcoded TPM quote nonce in Keylime. This flaw allows attackers to exploit the system by bypassing security measures, potentially leading to unauthorized access or manipulation of the system's integrity checks. The hardcoded nonce undermines the randomness and uniqueness required for secure operations, making it easier for malicious actors to predict or replicate valid responses.
How To Fix
Minimum fixed version
7.14.1-5.el10_2.1
This is the first release that contains the fix.
sudo dnf update keylimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as it is feasible.
Conclusion
The Keylime security update addresses a significant vulnerability (CVE-2026-6420) that could compromise system integrity through a hardcoded TPM quote nonce. Users are strongly advised to update their Keylime packages to the latest patched version to ensure the security of their systems.
See every vulnerability recorded for keylime →
FAQ
CVE-2026-6420 is a vulnerability in Keylime that allows security bypass due to a hardcoded TPM quote nonce.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to unauthorized access and manipulation of system integrity checks, compromising the security of the affected systems.
Yes, a patch is available. Update your Keylime packages to version 7.14.1-5.el10_2.1 to fix the vulnerability.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
