CVE-2026-6420 is a vulnerability in Keylime versions 7.14.0 through 7.14.1 where the attestation challenge nonce used in the push attestation protocol is hardcoded rather than randomly generated. This flaw allows an attacker with root access on a monitored agent node to stockpile valid TPM quotes and replay them to evade detection for approximately 8 to 33 minutes. The issue affects only the push attestation mode and is mitigated by TPM clock monotonicity checks and attestation timeouts. A fix restoring random nonce generation is available in Keylime version 7.14.2.