CVE-2026-1709 is a critical (CVSS 9.4) authentication bypass in the Keylime registrar from version 7.12.0. It does not require client certificates, so anyone who can reach its HTTPS port can list or delete agents. Apply the vendor update, and until then limit access to port 8891.
What's affected
The Keylime registrar, in versions 7.12.0 and later, until patched. Red Hat says Keylime packages in RHEL 9.6 and earlier are not affected, because they never shipped the version that introduced the issue.
Red Hat published errata for the issue: RHSA-2026:2224 for RHEL 9, RHSA-2026:2225 for RHEL 10 and RHSA-2026:2298 for RHEL 10.0 Extended Update Support. Fedora pushed keylime 7.14.1 builds to Fedora 42, 43 and 44 in March 2026. The pages we read do not name the first fixed upstream release, so check the upstream Keylime advisory for that.
How to check if you're exposed
Find the Keylime version and whether the registrar is running.
rpm -q keylime
pip show keylime
systemctl status keylime_registrar
Then check who can reach the registrar port. Red Hat gives the default as 8891.
ss -ltnp | grep 8891
From a host that should not have access, confirm that the port is blocked. The advisory says exploitation needs only network access to this port and a standard HTTP client, and that no credentials or certificates are needed.
What to do now
- Find every Keylime registrar and note its version and package source.
- Apply the vendor update: the Red Hat errata for RHEL 9 and 10, or the current Fedora or upstream package.
- Restrict port 8891 with firewall rules so only trusted verifier and tenant hosts reach it.
- Optionally place a reverse proxy such as Nginx or HAProxy in front of the registrar that enforces client certificates.
- Review the registrar for unexpected agent deletions and check that agent lists are intact.
Why it matters
The weakness is CWE-322 (Key Exchange without Entity Authentication), which MITRE names as key exchange without entity authentication. The registrar's TLS context did not set ssl.CERT_REQUIRED, so the server never insisted that clients present a certificate. The upstream fix adds that setting.
Keylime is attestation software. It is how you decide whether a machine can be trusted, so a registrar that anyone can read or edit weakens the whole check. Red Hat's description names listing agents, reading public TPM data and deleting agents. CISA does not list this CVE as known exploited.
Quick check
Are RHEL 9.6 and earlier affected?
Red Hat says no. Those Keylime packages never shipped the version that introduced the flaw.
Sources
Last reviewed: 19 October 2026.
