PT-2026-37443 · Keylime · Keylime

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-6420

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Keylime (affected versions not specified)

Description A flaw in the Keylime verifier allows an attacker with root access on an enrolled monitored machine to bypass security. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation—a process used to verify the integrity of a system—instead of a cryptographically random value. This enables an attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue specifically affects the push model deployment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-329

CWE-547

CWE-294

CWE-1241

Related Identifiers

CVE-2026-6420

GHSA-Q8W6-W55C-CCV5

GHSA-WC6P-4GWJ-JCR8

OPENSUSE-SU-2026:10779-1

Affected Products

Keylime

References · 11

• https://osv.dev/vulnerability/GHSA-q8w6-w55c-ccv5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6420 · Security Note
• https://osv.dev/vulnerability/GHSA-wc6p-4gwj-jcr8 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10779-1 · Vendor Advisory
• https://github.com/keylime/keylime · Note
• https://github.com/keylime/keylime/security/advisories/GHSA-q8w6-w55c-ccv5 · Note
• https://t.me/cveNotify/162308 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2458889 · Note
• https://t.me/CVEtracker/52852 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2026-6420 · Note
• https://suse.com/security/cve/CVE-2026-6420 · Note