affected:
- package:
    ecosystem: PyPI
    name: keylime
    purl: pkg:pypi/keylime
  ranges:
  - events:
    - introduced: '0'
    - fixed: 7.12.0
    type: ECOSYSTEM
  versions:
  - 6.3.1
  - 6.3.2
  - 6.4.0
  - 6.4.1
  - 6.4.2
  - 6.4.3
  - 6.5.0
  - 6.5.1
  - 6.5.2
  - 6.5.3
  - 6.6.0
  - 6.8.0
  - 7.0.0
  - 7.10.0
  - 7.2.5
  - 7.3.0
  - 7.4.0
  - 7.5.0
  - 7.6.0
  - 7.7.0
  - 7.8.0
  - 7.9.0
aliases:
- CVE-2026-1709
- GHSA-4jqp-9qjv-57m2
details: A flaw was found in Keylime. The Keylime registrar, since version 7.12.0,
  does not enforce client-side Transport Layer Security (TLS) authentication. This
  authentication bypass vulnerability allows unauthenticated clients with network
  access to perform administrative operations, including listing agents, retrieving
  public Trusted Platform Module (TPM) data, and deleting agents, by connecting without
  presenting a client certificate.
id: PYSEC-2026-74
modified: '2026-05-20T09:19:03.846821Z'
published: '2026-02-06T20:16:09.193Z'
references:
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:2224
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:2225
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:2298
- type: ADVISORY
  url: https://access.redhat.com/security/cve/CVE-2026-1709
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2435514
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4jqp-9qjv-57m2
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3