Bug 2435514 (CVE-2026-1709)

Summary:	CVE-2026-1709 keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-02-06

Description OSIDB Bzimport 2026-01-30 17:04:17 UTC

The Keylime registrar since version 7.12.0 does not require client-side TLS authentication because ssl.CERT_REQUIRED is not set when configuring the TLS context. This allows unauthenticated clients to perform administrative operations (list agents, retrieve public TPM data, delete agents) by connecting without presenting a client certificate.
Requirements to exploit:

* Network access to the registrar HTTPS port (default 8891)
* No credentials, certificates, or special tools required
* Standard HTTP client (curl, wget, etc.) is sufficient


Mitigation if available:
1. Network isolation - Restrict network access to registrar port 8891 to only trusted verifier and tenant hosts using firewall rules
2. Reverse proxy with mTLS - Deploy a reverse proxy (nginx, HAProxy) in front of the registrar that enforces client certificate authentication
3. Upgrade - Apply the fix when released (adds ssl.CERT_REQUIRED to enforce client certificate validation)

Comment 3 errata-xmlrpc 2026-02-09 01:27:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:2225 https://access.redhat.com/errata/RHSA-2026:2225

Comment 4 errata-xmlrpc 2026-02-09 02:43:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:2224 https://access.redhat.com/errata/RHSA-2026:2224

Comment 5 errata-xmlrpc 2026-02-09 09:40:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:2298 https://access.redhat.com/errata/RHSA-2026:2298

Comment 6 Fedora Update System 2026-03-04 00:55:34 UTC

FEDORA-2026-e5027335a3 (keylime-7.14.1-1.fc43 and keylime-agent-rust-0.2.9-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2026-03-04 01:25:15 UTC

FEDORA-2026-c2b5451b35 (keylime-7.14.1-1.fc42 and keylime-agent-rust-0.2.9-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2026-03-07 00:18:51 UTC

FEDORA-2026-2b8b223cf0 (keylime-7.14.1-1.fc44 and keylime-agent-rust-0.2.9-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.