Improper certificate validation in Red Hat Enterprise Linux 10
Priority MEDIUM 57CWE-322Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295 and CWE-306.
Summary
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0571 93rd percentileScored 2026-11-07
Fix Fixed keylime (PyPI): 7.12.2, 7.13.1Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | 7.12.1-11.el10_1.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 7.12.1-2.el10_0.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 7.12.1-11.el9_7.4 | Patch available | CNA |
| — | keylime (PyPI) | 7.12.0 to before 7.12.2 | 7.12.2 | Patch available | GHSA-4jqp-9qjv-57m2 |
| — | keylime (PyPI) | 7.13.0 to before 7.13.1 | 7.13.1 | Patch available | GHSA-4jqp-9qjv-57m2 |
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 7.12.1-11.el10_1.4 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 7.12.1-2.el10_0.5 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 7.12.1-11.el9_7.4 Patch available CNA
- keylime (PyPI) Vendor— Affected 7.12.0 to before 7.12.2 Fixed in 7.12.2 Patch available GHSA-4jqp-9qjv-57m2
- keylime (PyPI) Vendor— Affected 7.13.0 to before 7.13.1 Fixed in 7.13.1 Patch available GHSA-4jqp-9qjv-57m2
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* | 9.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64:10.0_aarch64:*:*:*:*:*:*:* | 10.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:10.0_aarch64:*:*:*:*:*:*:* | 10.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* | 9.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:* | 10.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:* | 10.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* | 9.0_ppc64le | Vulnerable | Red Hat |
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:10.0_aarch64:*:*:*:*:*:*:* Versions 10.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:10.0_aarch64:*:*:*:*:*:*:* Versions 10.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.0_s390x:*:*:*:*:*:*:* Versions 10.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:* | 10.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:* | 10.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:* | before 7.12.0 | Vulnerable | Keylime |
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.0_ppc64le:*:*:*:*:*:*:* Versions 10.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:* Versions before 7.12.0 Vulnerable ·Keylime
Remediation
- Fix · GHSA-4jqp-9qjv-57m2 keylime (PyPI) Fixed in 7.12.2 Advisory →
- Fix · GHSA-4jqp-9qjv-57m2 keylime (PyPI) Fixed in 7.13.1 Advisory →
Red Hat 3 advisories
- RHSA-2026:2298 Released 2026-02-09 · Red Hat rating Criticalkeylime security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) keylime-7.12.1-2.el10_0.5, keylime-base-7.12.1-2.el10_0.5, keylime-registrar-7.12.1-2.el10_0.5 +5
- RHSA-2026:2224 Released 2026-02-09 · Red Hat rating Criticalkeylime security update
- Red Hat Enterprise Linux AppStream (v. 9) keylime-7.12.1-11.el9_7.4, keylime-base-7.12.1-11.el9_7.4, keylime-registrar-7.12.1-11.el9_7.4 +4
- RHSA-2026:2225 Released 2026-02-09 · Red Hat rating Criticalkeylime security update
- Red Hat Enterprise Linux AppStream (v. 10) keylime-7.12.1-11.el10_1.4, keylime-base-7.12.1-11.el10_1.4, keylime-registrar-7.12.1-11.el10_1.4 +5
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:2225 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:2224 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:2298 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1709
- 2026-10-03 Alias added: GHSA-4jqp-9qjv-57m2
References
Advisory 6
More Red Hat Enterprise Linux vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
Sources
- CVE-2026-1709 · CVE Program
- CVE-2026-1709 · NVD
- FIRST EPSS
- GHSA-4jqp-9qjv-57m2 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-1709 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences