CVE-2026-1709 | Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

Published: 2026-02-06 Last update: 2026-06-27 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-1709 is rated High Risk (74.8/100): CVSS Critical severity, with high exploitation likelihood (EPSS 5.80%, 92th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +5.78% over the last day, indicating growing attacker interest. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-1709

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.03% 5.80% +5.78%
2 2026-02-18 0.06% 0.03% -0.03%
3 2026-02-09 — 0.06% —

Full EPSS history (4 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-1709

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.4 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.5 [email protected]
9.8 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.9 [email protected]
9.4 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.5 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Weakness enumeration for CVE-2026-1709

GitHub Security Advisory for CVE-2026-1709

GHSA-4jqp-9qjv-57m2 · Severity: critical · Ecosystem: pip — Keylime Missing Authentication for Critical Function and Improper Authentication

OS Trackers for CVE-2026-1709

vendor priority summary link
redhat critical — https://access.redhat.com/security/cve/CVE-2026-1709
suse critical CVE-2026-1709 severity critical: SUSE including 56 source package names (13.2-9.22:liblzma5-5.4.3-5.1, 13.2-9.22:xz-5.4.3-5.1, …), 232 product×package rows across 53 product lines (Container suse/sl-micro/6.0/baremetal-os-container, Container suse/sl-micro/6.0/base-os-container, … (53 product lines)): Fixed 133, Known Not Affected 91, First Fixed 8. https://www.suse.com/security/cve/CVE-2026-1709/
ubuntu medium CVE-2026-1709 medium priority: Ubuntu has no source package entries, 0 status rows across 0 suites (none): no status rows. https://ubuntu.com/security/CVE-2026-1709

Affected software / configurations for CVE-2026-1709

Vendor Product Version Raw CPE
keylime keylime < 7.12.0 cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:*
redhat enterprise_linux 9.0 cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
redhat enterprise_linux 10.0 cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 10.0 cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 9.0_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64 10.0_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64:10.0_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_arm_64_eus 10.0_aarch64 cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:10.0_aarch64:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 9.0_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems 10.0_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_ibm_z_systems_eus 10.0_s390x cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian 9.0_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian 10.0_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:*
redhat enterprise_linux_for_power_little_endian_eus 10.0_ppc64le cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:*

References for CVE-2026-1709

cvelogic Threat Intelligence