CVE-2026-6420 describes a security bypass vulnerability in Keylime, a TPM-based remote boot attestation and runtime integrity measurement solution included in Red Hat Enterprise Linux 10. The Keylime verifier uses a hardcoded challenge nonce for TPM quote attestation rather than a cryptographically secure random nonce. An attacker with root privileges on a monitored machine can exploit this by collecting valid TPM quotes and replaying them to evade detection after system compromise. This vulnerability affects only the push model deployment of Keylime. Red Hat has issued a security update (keylime-7.14.1-5.el10_2.1) to fix this issue.

An attacker with root access on an enrolled monitored machine can bypass security checks by replaying previously collected valid TPM quotes due to the predictable nonce used in the Keylime verifier. This can lead to evasion of detection mechanisms that rely on TPM quote attestation, resulting in a high impact on confidentiality and integrity, and a low impact on availability. The CVSS 3.1 base score is 6.3 (medium severity).

Red Hat has released an official security update for Keylime in Red Hat Enterprise Linux 10 that addresses this vulnerability by replacing the hardcoded TPM quote nonce with a cryptographically random value. Users should apply the update keylime-7.14.1-5.el10_2.1 or later as provided in Red Hat Security Advisory RHSA-2026:28582. Refer to https://access.redhat.com/articles/11258 for detailed update instructions. No other mitigations are indicated by the vendor advisory.