Skip to content
Fencer Vulns
medium 6.3

CVE-2026-6420 json

Keylime: keylime: security bypass due to hardcoded tpm quote nonce

published 2026-05-06 6 mo ago modified 2026-11-05 3 d ago also GHSA-q8w6-w55c-ccv5 , PYSEC-2026-2548 , EUVD-2026-27657

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.

Patch / fix

  • pypi keylime 7.14.2
  • Red Hat Red Hat Enterprise Linux 10 0:7.14.1-5.el10_2.1
  • keylime RHEL 10.2 7.14.1-5.el10_2.1
  • keylime-base RHEL 10.2 7.14.1-5.el10_2.1
  • keylime-tools RHEL 10.2 7.14.1-5.el10_2.1
  • keylime-tenant RHEL 10.2 7.14.1-5.el10_2.1
  • keylime-selinux RHEL 10.2 7.14.1-5.el10_2.1
  • python3-keylime RHEL 10.2 7.14.1-5.el10_2.1
  • keylime-verifier RHEL 10.2 7.14.1-5.el10_2.1
  • keylime-registrar RHEL 10.2 7.14.1-5.el10_2.1

red hat advisories RHSA-2026:28582

  • keylime SLES for SAP applications 16.0, SLES 16.0 7.14.2-160000.1.1

suse advisories SUSE-SU-2026:22326-1

  • keylime openSUSE Leap 16.0 7.14.2-160000.1.1
  • keylime openSUSE Tumbleweed 7.14.2-1.1

opensuse advisories openSUSE-SU-2026:21025-1openSUSE-SU-2026:10779-1

  • keylime AlmaLinux 10 7.14.1-5.el10_2.1
  • keylime-base AlmaLinux 10 7.14.1-5.el10_2.1
  • keylime-tools AlmaLinux 10 7.14.1-5.el10_2.1
  • keylime-tenant AlmaLinux 10 7.14.1-5.el10_2.1
  • keylime-selinux AlmaLinux 10 7.14.1-5.el10_2.1
  • python3-keylime AlmaLinux 10 7.14.1-5.el10_2.1
  • keylime-verifier AlmaLinux 10 7.14.1-5.el10_2.1
  • keylime-registrar AlmaLinux 10 7.14.1-5.el10_2.1

almalinux advisories ALSA-2026:28582

  • keylime Rocky Linux 10 7.14.1-5.el10_2.1

rocky linux advisories RLSA-2026:28582

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6420 updated cvss 6.3

keylime: Keylime: Security bypass due to hardcoded TPM quote nonce

  • Red Hat Enterprise Linux 9 keylime, keylime-base, keylime-tenant, keylime-selinux, python3-keylime, keylime-verifier, +1 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 10) keylime 7.14.1-5.el10_2.1, keylime-base 7.14.1-5.el10_2.1, keylime-tools 7.14.1-5.el10_2.1, keylime-tenant 7.14.1-5.el10_2.1, keylime-selinux 7.14.1-5.el10_2.1, python3-keylime 7.14.1-5.el10_2.1, +2 more
    fixed: vendor fix RHSA-2026:28582

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
GitHub 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
OSV 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
pypi keylime
>=7.14.0, <7.14.2
7.14.2

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-1241 Use of Predictable Algorithm in Random Number Generator
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-329 Generation of Predictable IV with CBC Mode
  • CWE-547 Use of Hard-coded, Security-relevant Constants

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.