Keylime
15 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Keylime, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Keylime CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High6
- Medium4
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Keylime.
- CVE-2026-1709Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication9.4
- CVE-2025-13609Keylime: keylime: registrar allows identity takeover via duplicate uuid registration8.2
- CVE-2025-1057Keylime: keylime registrar dos due to incompatible database entry handling4.3
- CVE-2023-38201Keylime: challenge-response protocol bypass during agent registration6.5
- CVE-2023-38200Keylime: registrar is subject to a dos against ssl connections7.5
- CVE-2023-3674Keylime: attestation failure when the quote's signature does not validate2.3
- CVE-2022-3500A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create erro...5.1
- CVE-2022-23952In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.7.5
- CVE-2022-23951In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.5.5
- CVE-2022-23950In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.7.5
- CVE-2022-23949In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.7.5
- CVE-2021-43310A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remot...9.8
- CVE-2022-23948A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to oth...7.5
- CVE-2022-1053Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allo...9.1
- CVE-2021-3406A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.9.8
Product grouping is registry-driven, with AI assist and human review. How it works