External risk intelligence

Keylime Registrar TLS Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-1709

Keylime is a remote boot attestation solution typically deployed within internal data center or cloud environments to manage trust for compute nodes. While it is network-reachable, its role as a security infrastructure component means it is usually isolated behind internal network controls rather than exposed directly to the public internet.

Authentication Bypass

Redhat Enterprise Linux

9.010.09.0_aarch6410.0_aarch649.0_s390x10.0_s390x9.0_ppc64le10.0_ppc64lebefore 7.12.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Keylime system, specifically affecting its registrar component. This flaw allows unauthenticated access to sensitive administrative functions by bypassing client-side Transport Layer Security authentication. The potential implications include unauthorized listing of agents, retrieval of critical Trusted Platform Module data, and deletion of agents, all without proper authorization.

Unauthenticated access to administrative Keylime functions.
Critical data exposure and agent management unauthorized.
Confirm relevance and exposure to Keylime deployments.

Attack Path

How an attacker could exploit the issue

An attacker with network access to the Keylime registrar can bypass client-side authentication. This allows them to perform administrative actions without needing to present a client certificate, leading to unauthorized access and potential manipulation of sensitive system data.

Network access required for entry.
Bypasses client-side TLS authentication.
Unauthorized administrative operations.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated clients with network access could perform administrative operations on the Keylime registrar, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents. This could occur by connecting without presenting a client certificate, bypassing the need for authentication.

Keylime registrar administrative functions.
Network access bypasses TLS authentication.
Unauthorized data retrieval and agent manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Keylime team or the platform team responsible for its deployment are likely to own this issue. The first practical step involves identifying all Keylime registrar instances, confirming their network accessibility, and assessing their criticality to business operations to prioritize remediation efforts.

Identify Keylime registrar instances.
Verify network exposure and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Keylime and why do organizations use it?

Keylime is an open-source framework used for remote boot attestation and runtime integrity monitoring. Organizations rely on it to ensure the trustworthiness of compute nodes by leveraging Trusted Platform Module (TPM) hardware. It verifies that systems have booted securely and maintains their integrity state over time, serving as a foundational security layer for validating software and hardware configuration across large-scale infrastructure environments.

What does CVE-2026-1709 mean for Keylime security?

This CVE describes a critical authentication bypass vulnerability, classified as CWE-322 (Key Exchange Weakness). Essentially, the Keylime registrar fails to enforce mandatory client-side TLS certificates. This allows anyone with network access to the registrar to interact with it as an administrator, enabling them to query agent lists, access sensitive TPM data, or remove agents from the system without proving their identity.

How can an attacker trigger this Keylime vulnerability?

An attacker triggers this flaw by connecting to the Keylime registrar over the network while deliberately omitting the required TLS client certificate. Because the registrar does not validate or enforce the presence of this certificate, it accepts the connection anyway. Note that this bug is not triggered by legitimate, properly authenticated administrators who are correctly using client-side certificates.

Do I need to worry about this vulnerability in my environment?

While the issue is critical, Halo Surface Signal notes that Keylime is typically deployed as internal security infrastructure rather than public-facing software. The risk is highest if your registrar is accessible over a broad, untrusted network. You should prioritize assessment if your network architecture allows unauthorized segments or external entities to reach the registrar service directly.

What should I do if I am running affected Keylime versions?

Start by locating all instances of the Keylime registrar across your environment to establish your current footprint. Once identified, evaluate the network accessibility of these instances to determine if they are exposed to unauthorized users. Work with your security or infrastructure team to apply the necessary updates or patches, and monitor the registrar for any unusual connection attempts until the update is fully deployed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.