CVE-2026-1709 is an authentication bypass vulnerability in the Keylime registrar component, introduced since version 7.12.0. The vulnerability arises because the registrar does not enforce client-side TLS authentication, allowing unauthenticated network clients to perform privileged administrative operations. This includes listing agents, retrieving public TPM data, and deleting agents. The vulnerability is tracked under CWE-322 (Key Exchange without Entity Authentication). Red Hat has issued security advisories and released updated packages (version 7.12.1) for Red Hat Enterprise Linux 9 and 10 to fix this issue.

The vulnerability allows unauthenticated attackers with network access to bypass client-side TLS authentication and perform unauthorized administrative actions on the Keylime registrar. This can lead to information disclosure (e.g., TPM public data) and disruption of service by deleting agents. The CVSS v3.1 base score is 9.4 (critical), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability.

Red Hat has released official security updates that fix this vulnerability by enforcing client-side TLS authentication in Keylime registrar. Users should apply the updated packages (version 7.12.1 or later) for their respective Red Hat Enterprise Linux 9 or 10 installations. Refer to the Red Hat advisory and article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigations are required once the update is applied.