CVE-2026-6420

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6420", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-04-16T06:03:46.656Z", "datePublished": "2026-05-06T10:19:39.121Z", "dateUpdated": "2026-11-05T21:55:40.613Z"}, "containers": {"cna": {"title": "Keylime: keylime: security bypass due to hardcoded tpm quote nonce", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment."}], "affected": [{"versions": [{"status": "affected", "version": "7.14.0", "lessThan": "7.14.2", "versionType": "semver"}], "packageName": "keylime", "collectionURL": "https://github.com/keylime/keylime", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "keylime", "defaultStatus": "affected", "versions": [{"version": "0:7.14.1-5.el10_2.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "keylime", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:28582", "name": "RHSA-2026:28582", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-6420", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458889", "name": "RHBZ#2458889", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-05-06T10:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-1241", "description": "Use of Predictable Algorithm in Random Number Generator", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-1241: Use of Predictable Algorithm in Random Number Generator", "workarounds": [{"lang": "en", "value": "Primary fix (one-line change in keylime/models/verifier/evidence.py):\nBefore (vulnerable):\ndef generate_challenge(self, bit_length):\n\nself.challenge = Nonce.generate(bit_length)\n self.challenge = bytes.fromhex(\"49beed365aac777dae23564f5ad0ec\")\n\nAfter (fixed):\ndef generate_challenge(self, bit_length):\nself.challenge = Nonce.generate(bit_length)\n\nExisting partial mitigations (already active):\n\n1. TPM clock monotonicity check: limits each quote to one replay.\n2. Push attestation timeout (default 10s): constrains the quote generation window, but TPM throughput allows 50-200 quotes to be stockpiled in that time."}], "timeline": [{"lang": "en", "time": "2026-04-16T06:01:38.993Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-06T10:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Keylime developers for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T21:55:40.613Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T13:54:45.881598Z", "id": "CVE-2026-6420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T15:24:21.052Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T13:54:45.881598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:54:49.240Z"}}], "cna": {"title": "Keylime: keylime: security bypass due to hardcoded tpm quote nonce", "credits": [{"lang": "en", "value": "Red Hat would like to thank Keylime developers for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "affected", "version": "7.14.0", "lessThan": "7.14.2", "versionType": "semver"}], "packageName": "keylime", "collectionURL": "https://github.com/keylime/keylime", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:7.14.1-5.el10_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "keylime", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "keylime", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-16T06:01:38.993Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-06T10:00:00.000Z", "value": "Made public."}], "datePublic": "2026-05-06T10:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:28582", "name": "RHSA-2026:28582", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-6420", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458889", "name": "RHBZ#2458889", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Primary fix (one-line change in keylime/models/verifier/evidence.py):\nBefore (vulnerable):\ndef generate_challenge(self, bit_length):\n\nself.challenge = Nonce.generate(bit_length)\n self.challenge = bytes.fromhex(\"49beed365aac777dae23564f5ad0ec\")\n\nAfter (fixed):\ndef generate_challenge(self, bit_length):\nself.challenge = Nonce.generate(bit_length)\n\nExisting partial mitigations (already active):\n\n1. TPM clock monotonicity check: limits each quote to one replay.\n2. Push attestation timeout (default 10s): constrains the quote generation window, but TPM throughput allows 50-200 quotes to be stockpiled in that time."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1241", "description": "Use of Predictable Algorithm in Random Number Generator"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T21:55:40.613Z"}, "x_redhatCweChain": "CWE-1241: Use of Predictable Algorithm in Random Number Generator"}}, "cveMetadata": {"cveId": "CVE-2026-6420", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:55:40.613Z", "dateReserved": "2026-04-16T06:03:46.656Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-05-06T10:19:39.121Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/keylime/keylime", "defaultStatus": "unaffected", "packageName": "keylime", "versions": [{"lessThan": "7.14.2", "status": "affected", "version": "7.14.0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "keylime", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.14.1-5.el10_2.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "keylime", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Keylime. Un atacante con acceso de root en una m\u00e1quina monitoreada registrada, donde se ejecuta el agente de Keylime, puede explotar una vulnerabilidad en el verificador de Keylime. El verificador utiliza un nonce de desaf\u00edo codificado para la atestaci\u00f3n de cita del M\u00f3dulo de Plataforma Confiable (TPM) en lugar de un valor criptogr\u00e1ficamente aleatorio. Esto permite al atacante acumular citas TPM v\u00e1lidas y reproducirlas para evadir la detecci\u00f3n despu\u00e9s de comprometer el sistema. Este problema afecta solo al despliegue del modelo push."}], "id": "CVE-2026-6420", "lastModified": "2026-11-05T22:18:52.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.5, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6420", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T13:54:45.881598Z", "version": "2.0.3"}}]}, "published": "2026-05-06T11:16:05.193", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:28582"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-6420"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458889"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1241"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Keylime developers for reporting this issue.", "bugzilla": {"description": "keylime: Keylime: Security bypass due to hardcoded TPM quote nonce", "id": "2458889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458889"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-1241", "details": ["A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment."], "mitigation": {"lang": "en:us", "value": "Primary fix (one-line change in keylime/models/verifier/evidence.py):\nBefore (vulnerable):\ndef generate_challenge(self, bit_length):\nself.challenge = Nonce.generate(bit_length)\nself.challenge = bytes.fromhex(\"49beed365aac777dae23564f5ad0ec\")\nAfter (fixed):\ndef generate_challenge(self, bit_length):\nself.challenge = Nonce.generate(bit_length)\nExisting partial mitigations (already active):\n1. TPM clock monotonicity check: limits each quote to one replay.\n2. Push attestation timeout (default 10s): constrains the quote generation window, but TPM throughput allows 50-200 quotes to be stockpiled in that time."}, "name": "CVE-2026-6420", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "keylime", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "keylime", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T10:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-6420\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6420"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}], "created": "2026-05-06T12:00:03.490243+00:00", "updated": "2026-05-07T21:25:51.343701+00:00", "vendors": ["redhat", "redhat$PRODUCT$enterprise_linux"]}