CVE-2026-1709: Keylime Registrar TLS Client Authentication Bypass
CVE-2026-1709 is a critical authentication bypass in the Keylime registrar, which the record says does not enforce client-side TLS authentication. According to the record, an unauthenticated client with network access could perform administrative operations such as listing agents, retrieving public TPM data and deleting agents. The sources consulted show no confirmed exploitation, and the record lists no fixed version.
Overview
CVE-2026-1709 affects the Keylime registrar. The record states that the registrar, since version 7.12.0, does not enforce client-side TLS authentication. The record classifies the issue as an authentication bypass and places it under CWE-322.
Impact
According to the record, an unauthenticated client with network access can reach administrative operations by connecting without a client certificate. The operations named are listing agents, retrieving public Trusted Platform Module (TPM) data and deleting agents. The NVD base score is 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network reachability, no privileges and no user interaction. Red Hat reports 9.4 under the same version.
Affected products and versions
- Keylime: the record lists versions below 7.12.0 as affected, which conflicts with the description's statement that the flaw exists since 7.12.0.
- Red Hat Enterprise Linux: the record lists versions 9.0 and 10.0, including Extended Update Support and the aarch64, s390x and ppc64le variants.
The record does not list any fixed version. A missing fixed version does not mean no fix exists. Consult the Red Hat advisories referenced in the record for product-specific status.
Exploitation status
The KEV catalog entry is marked as not listed in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.05794 (percentile 0.92961) with the date given in the record, which estimates likelihood of exploitation but does not confirm it.
Remediation and mitigation
- Identify every Keylime registrar deployment and its version, including those packaged in Red Hat Enterprise Linux.
- Review the Red Hat advisories listed in the references and apply the updates your vendor provides once they are confirmed for your product line.
- Until a fix is verified, restrict network access to the registrar to trusted management hosts and enforce segmentation so that untrusted clients cannot reach it.
- Review whether the registrar is exposed beyond the trusted network and reduce that exposure.
Detection guidance
- Monitor registrar access logs for administrative activity from unexpected sources or without expected client identity.
- Watch for unexplained removal or changes to registered agents and correlate them with change records.
- Alert on TLS handshake patterns that show clients connecting without certificates to services that normally require them.
Limitations of the available information
The record has no title, no fixed version, no CWE name, and no KEV details. The version range in the affected data (below 7.12.0) conflicts with the description (since 7.12.0), and the cause of the conflict is unknown. The Red Hat advisory contents were not reviewed beyond their listing in the record. The EPSS date in the record is later than the publication date, so its timing should be checked against the source.
Frequently asked questions
What does CVE-2026-1709 allow?
According to the record, an unauthenticated client with network access can perform administrative operations on the Keylime registrar, such as listing agents, retrieving public TPM data and deleting agents, by connecting without a client certificate.
Is this vulnerability being exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS score estimates likelihood but does not confirm exploitation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.