6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6420

CVE-2026-6420: Keylime: keylime: security bypass due to hardcoded tpm quote nonce

A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6420

CVE-2026-6420:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keylime	pip	>= 7.14.0, <= 7.14.1	7.14.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by a hardcoded nonce in the push attestation protocol, which enables replay attacks. The introducing commit 2bf91197 was analyzed, which refactored the verification logic and introduced the vulnerable code. The function CertificationParameters.generate_challenge in keylime/models/verifier/evidence.py was identified as the root cause, as it sets a static nonce value instead of a randomly generated one. The patch evidence clearly shows the hardcoded hex string. Additionally, the function EvidenceItem.generate_challenge was identified as a runtime indicator because it directly calls the vulnerable function. An attacker with root access on an agent can pre-calculate TPM quotes with this known nonce and replay them later to evade detection of a system compromise.

Vulnerable functions

CertificationParameters.generate_challenge

keylime/models/verifier/evidence.py

This function uses a hardcoded nonce for the attestation challenge, which allows replay attacks. The line to generate a random nonce is commented out and replaced with a static value.

EvidenceItem.generate_challenge

keylime/models/verifier/evidence.py

This function is a caller of the vulnerable `CertificationParameters.generate_challenge` function. It would appear in the stack trace when the vulnerability is triggered, as it's responsible for initiating the challenge generation process for a given evidence item.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.