A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_28582 advisory.

    * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28582 advisory.

    [7.14.1-6]
    - keylime: Fix hardcoded attestation challenge nonce (CVE-2026-6420)       [RHEL-168795]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:28582 advisory.

    * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:28582 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-513c495139 advisory.

    Updating for Keylime release v7.14.2:

     - This includes the fix for CVE-2026-6420.
     - Update keylime-selinux policy to the latest version 44.1.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9064cdf8ef advisory.

    Updating for Keylime release v7.14.2:

     - This includes the fix for CVE-2026-6420.
     - Update keylime-selinux policy to the latest version 44.1.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the     Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded     challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random     value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after     compromising the system. This issue affects only the push model deployment. (CVE-2026-6420)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
357840	Rocky Linux 10.2 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2026_28582)	Nessus	Rocky Linux Local Security Checks	Local	medium
327503	Oracle Linux 10 : keylime (ELSA-2026-28582)	Nessus	Oracle Linux Local Security Checks	Local	medium
322765	RockyLinux 10 : keylime (RLSA-2026:28582)	Nessus	Rocky Linux Local Security Checks	Local	medium
322331	RHEL 10 : keylime (RHSA-2026:28582)	Nessus	Red Hat Local Security Checks	Local	medium
319616	Fedora 43 : keylime (2026-513c495139)	Nessus	Fedora Local Security Checks	Local	medium
319614	Fedora 44 : keylime (2026-9064cdf8ef)	Nessus	Fedora Local Security Checks	Local	medium
312583	Linux Distros Unpatched Vulnerability : CVE-2026-6420	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-6420

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium