CVE & CISA-KEV Catalog

CVE-2026-6420

MEDIUM
6.3
CVSS v3
NVD

Description

A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.

How to fix

Remediation Available
keylimeRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylimeRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-baseRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-baseRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-registrarRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-registrarRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-selinuxRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-selinuxRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-tenantRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-tenantRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-toolsRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-toolsRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-verifierRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
keylime-verifierRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
python3-keylimeRed Hat / RHEL
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
python3-keylimeRocky
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582
Fixed in:0:7.14.1-5.el10_2.1RHSA-2026:28582

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityLow

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Exploit Intelligence

0.12%probability of exploitation in 30 days
2ndpercentile

Low risk: more likely to be exploited than 2% of all known CVEs.

References

Embed a live status badge for CVE-2026-6420
CVE-2026-6420 severity badge

Markdown

[![CVE-2026-6420](https://tridentstack.com/cve/badge/CVE-2026-6420.svg)](https://tridentstack.com/cve/CVE-2026-6420)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-6420"><img src="https://tridentstack.com/cve/badge/CVE-2026-6420.svg" alt="CVE-2026-6420"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-06-24.