Critical Security Bypass in Fedora Keylime Affects Multiple Versions

Linuxsecurity

Critical Security Bypass in Fedora Keylime Affects Multiple Versions

First seen 7 Jun 2026, 06:19 UTC • •70.5

Article Content

1 / 3

Browse articles

ThreatCluster •June 8, 2026 at 05:47 UTC

•CVE-2026-6420 is a critical security bypass affecting Fedora Keylime versions.
•The vulnerability is due to a hardcoded TPM quote nonce, allowing potential unauthorized access.
•Users are urged to update to keylime-selinux policy version 44.1.0 immediately.

Fedora has released a critical update for Keylime version 7.14.2 to address CVE-2026-6420, a security bypass vulnerability caused by a hardcoded TPM quote nonce. This flaw affects users of Fedora 43 and 44, potentially allowing unauthorized access to sensitive data. The vulnerability was published on May 6, 2026, and has been confirmed to impact the keylime-selinux policy. Users are advised to upgrade to the latest version (44.1.0) to mitigate risks. The update can be installed using the 'dnf' package manager. As of June 7, 2026, no active exploitation has been reported, but the severity of the vulnerability necessitates immediate attention from system administrators.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 135d ago How this analysis works

Timeline

2026-05-06

CVE-2026-6420 published

CVE-2026-6420 was published, detailing a security bypass in Keylime due to a hardcoded TPM quote nonce.

2026-05-27

Keylime release v7.14.2 issued

Fedora released Keylime version 7.14.2, which includes a fix for CVE-2026-6420 and updates to the keylime-selinux policy.

2026-06-07

Security advisory published

Fedora issued a security advisory urging users to upgrade to the latest keylime-selinux policy to address CVE-2026-6420.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Vulnerability (1)

CVE-2026-6420

Weakness (2)

CWE-287 - Improper Authentication
CWE-798 - Use of Hard-coded Credentials

Relationships

CVE-2026-6420 related to Zero-day Exploit
CVE-2026-6420 related to CWE-287 - Improper Authentication
CVE-2026-6420 related to CWE-798 - Use of Hard-coded Credentials

Following this threat?

Track CVE-2026-6420 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…