The Keylime registrar since version 7.12.0 does not require client-side TLS authentication because ssl.CERT_REQUIRED is not set when configuring the TLS context. This allows unauthenticated clients to perform administrative operations (list agents, retrieve public TPM data, delete agents) by connecting without presenting a client certificate. Requirements to exploit: * Network access to the registrar HTTPS port (default 8891) * No credentials, certificates, or special tools required * Standard HTTP client (curl, wget, etc.) is sufficient Mitigation if available: 1. Network isolation - Restrict network access to registrar port 8891 to only trusted verifier and tenant hosts using firewall rules 2. Reverse proxy with mTLS - Deploy a reverse proxy (nginx, HAProxy) in front of the registrar that enforces client certificate authentication 3. Upgrade - Apply the fix when released (adds ssl.CERT_REQUIRED to enforce client certificate validation)
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:2225 https://access.redhat.com/errata/RHSA-2026:2225
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:2224 https://access.redhat.com/errata/RHSA-2026:2224