NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · PyPI

GHSA-27jc-jmp8-qfw5: Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication

criticalCVSS 3.1 9.4

This advisory was withdrawn on Feb 6, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4jqp-9qjv-57m2. This link is maintained to preserve external references. Original Description A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication.

Published Feb 6, 2026 · Updated Feb 9, 2026

Affected packages

keylime

Ecosystem
PyPI
Affected
>= 7.12.0, < 7.12.2
Fixed in
7.12.2
Check
pip show keylime

keylime

Ecosystem
PyPI
Affected
= 7.13.0
Fixed in
7.13.1
Check
pip show keylime

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-4jqp-9qjv-57m2. This link is maintained to preserve external references.

Original Description

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries