CVE-2026-6420

MediumCVSS 6.3/10Last modified Aug 26, 2026

Description

A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-1241

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 6, 2026
Last modified: Aug 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-642007.3There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past th CVE-2026-642017.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642027.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642037.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642047.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642055.5In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A sever CVE-2026-642068.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2ca CVE-2026-642075.5In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a G CVE-2026-642087.5In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks C CVE-2026-642097.1In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config CVE-2026-64217.0A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The ma CVE-2026-642107.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when t