CVE-2025-13609 Keylime: keylime: registrar allows identity takeover via duplicate uuid registration
Attackers can impersonate legitimate agents by registering with a duplicate UUID, bypassing security controls and gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13609?
CVE-2025-13609 is a high-severity authentication bypass vulnerability in Keylime Project Red Hat Enterprise Linux 10, published on 24 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Weakness: CWE-694
Which versions are affected by CVE-2025-13609?
3 open source packages ship an affected version, including keylime.
| Package | Affected | Fixed in |
|---|---|---|
keylime PyPI | All versions | None |
keylime PyPI | All versions | 7.13.0 |
keylime PyPI | All versions | 7.13.0 |
Linux distribution packages (37)
keylime-selinux AlmaLinux:10 | All versions | 7.12.1-11.el10_1.3 |
keylime AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
keylime-base AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
keylime-registrar AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
keylime-selinux AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
keylime-tenant AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
keylime-verifier AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
python3-keylime AlmaLinux:9 | All versions | 7.12.1-11.el9_7.3 |
keylime Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime-base Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime-registrar Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime-selinux Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime-tenant Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime-tools Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime-verifier Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
python3-keylime Red Hat:enterprise_linux:10.1 | All versions | 0:7.12.1-11.el10_1.3 |
keylime Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
keylime-base Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
keylime-registrar Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
keylime-selinux Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
keylime-tenant Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
keylime-verifier Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
python3-keylime Red Hat:enterprise_linux:9::appstream | All versions | 0:7.12.1-11.el9_7.3 |
keylime Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
keylime-base Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
keylime-registrar Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
keylime-tenant Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
keylime-tools Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
keylime-verifier Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
python3-keylime Red Hat:enterprise_linux_eus:10.0 | All versions | 0:7.12.1-2.el10_0.4 |
keylime Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
keylime-base Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
keylime-registrar Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
keylime-selinux Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
keylime-tenant Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
keylime-verifier Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
python3-keylime Red Hat:rhel_e4s:9.2::appstream | All versions | 0:6.5.2-6.el9_2.1 |
How do I fix CVE-2025-13609?
Upgrade keylime to 7.13.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-13609 being exploited?
There is no known exploitation of CVE-2025-13609 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:23201, ALSA-2025:23210, CLSA-2025-1766502382, GHSA-xh5w-g8gq-r3v9, PYSEC-2025-77, RHSA-2025:23201 and 9 more.