CVE-2026-1709

Katalog CVE

CVSS 9.8 · Critical EPSS 5,8%

Kerentanan Key Exchange without Entity Authentication pada redhat enterprise linux, redhat enterprise linux eus +7 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-322: Key Exchange without Entity Authentication

EPSS (30 hari)

5,8% peluang dieksploitasi; lebih tinggi dari 92,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:2224 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:2225 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:2298 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-1709 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2435514 issue tracking · advisory pihak ketiga
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1709.json