CVE-2026-6420 Keylime: keylime: security bypass due to hardcoded tpm quote nonce
Attackers with root access can bypass TPM attestation in Keylime push model deployments by replaying quotes due to a hardcoded nonce.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6420?
CVE-2026-6420 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.
Weakness: CWE-1241
Which versions are affected by CVE-2026-6420?
3 open source packages ship an affected version, including keylime.
| Package | Affected | Fixed in |
|---|---|---|
keylime PyPI | From 7.14.0 | 7.14.2 |
keylime PyPI | From 7.14.0 | 7.14.2 |
keylime PyPI | From 7.14.0 | 7.14.2 |
Linux distribution packages (21)
keylime AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime-base AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime-registrar AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime-selinux AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime-tenant AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime-tools AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime-verifier AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
python3-keylime AlmaLinux:10 | All versions | 7.14.1-5.el10_2.1 |
keylime Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime-base Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime-registrar Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime-selinux Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime-tenant Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime-tools Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime-verifier Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
python3-keylime Red Hat:enterprise_linux:10.2 | All versions | 0:7.14.1-5.el10_2.1 |
keylime Rocky Linux:10 | All versions | 0:7.14.1-5.el10_2.1 |
keylime SUSE:Linux Enterprise Server 16.0 | All versions | 7.14.2-160000.1.1 |
keylime SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 7.14.2-160000.1.1 |
keylime openSUSE:Leap 16.0 | All versions | 7.14.2-160000.1.1 |
keylime openSUSE:Tumbleweed | All versions | 7.14.2-1.1 |
How do I fix CVE-2026-6420?
Upgrade keylime to 7.14.2 or later.
Is CVE-2026-6420 being exploited?
There is no known exploitation of CVE-2026-6420 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:28582, GHSA-q8w6-w55c-ccv5, PYSEC-2026-2548, RHSA-2026:28582, RLSA-2026:28582, SUSE-SU-2026:22326-1 and 2 more.