RHSA-2026:28582MediumCVSS 6.3

Red Hat Security Advisory: keylime security update

Published
June 24, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-6420 →

📋 Description

CVE-2026-6420 — keylime: Keylime: Security bypass due to hardcoded TPM quote nonce

🎯 Affected products31

  • Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-0:7.14.1-5.el10_2.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-0:7.14.1-5.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-base-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-base-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-base-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-base-0:7.14.1-5.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-registrar-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-registrar-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-registrar-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-registrar-0:7.14.1-5.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-selinux-0:7.14.1-5.el10_2.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tenant-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tenant-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tenant-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tenant-0:7.14.1-5.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tools-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tools-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tools-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-tools-0:7.14.1-5.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-verifier-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-verifier-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-verifier-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • keylime-verifier-0:7.14.1-5.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-keylime-0:7.14.1-5.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-keylime-0:7.14.1-5.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • python3-keylime-0:7.14.1-5.el10_2.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +1 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Primary fix (one-line change in keylime/models/verifier/evidence.py): Before (vulnerable): def generate_challenge(self, bit_length): self.challenge = Nonce.generate(bit_length) self.challenge = bytes.fromhex("49beed365aac777dae23564f5ad0ec") After (fixed): def generate_challenge(self, bit_length): self.challenge = Nonce.generate(bit_length) Existing partial mitigations (already active): 1. TPM clock monotonicity check: limits each quote to one replay. 2. Push attestation timeout (default 10s): constrains the quote generation window, but TPM throughput allows 50-200 quotes to be stockpiled in that time.

🔗 References (4)