CVE-2026-6420 Details
Description
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.
A vulnerability exists in the Keylime verifier due to the use of a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation, rather than a cryptographically random value. This flaw allows an attacker with root access on an enrolled monitored machine, where the Keylime agent operates, to collect valid TPM quotes and replay them to avoid detection after compromising the system. This issue is present only in push model deployments.
The vulnerability has been fixed in Keylime by changing the nonce generation to use a cryptographically random value instead of a hardcoded one. Users should update to the latest version of Keylime to apply this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1241 | Use of Predictable Algorithm in Random Number Generator | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | CVE Modified | [email protected] |
| Jun 24, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |