CRITICAL9.4PyPI
GHSA-4jqp-9qjv-57m2· CVE-2026-1709, PYSEC-2026-74Keylime Missing Authentication for Critical Function and Improper Authentication
Modified: 6/6/2026
package
PyPI/keylime
pkg:pypi/keylime
MEDIUM4.3PyPI
GHSA-9jxq-5x44-gx23· CVE-2025-1057, PYSEC-2026-1488Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0
Modified: 7/21/2026
MEDIUM6.5PyPI
GHSA-f4r5-q63f-gcww· CVE-2023-38201, PYSEC-2023-160Keylime registrar and (untrusted) Agent can be bypassed by an attacker
Modified: 7/8/2026
LOW2.3PyPI
GHSA-g4wg-cfpf-9689· CVE-2023-3674, PYSEC-2023-128keylime fails to flag device as untrusted when signature does not validate
Modified: 2/15/2025
MEDIUM5.1PyPI
GHSA-hff2-x2j9-gxgv· CVE-2022-3500, PYSEC-2022-42995Keylime: unhandled exceptions could lead to invalid attestation states
Modified: 4/29/2025
CRITICAL9.1PyPI
GHSA-jf66-3q76-h5p5· CVE-2022-1053, GHSA-jf66-3q76-h5p5,Tenant and Verifier might not use the same registrar data
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-pg75-v6fp-8q59· CVE-2023-38200, PYSEC-2026-1489Keylime's registrar vulnerable to Denial-of-service attack via a single open connection
Modified: 7/7/2026
MEDIUM6.3PyPI
GHSA-q8w6-w55c-ccv5· CVE-2026-6420, PYSEC-2026-2548Keylime has a hardcoded attestation challenge nonce that allows replay attacks
Modified: 7/13/2026
HIGH8.2PyPI
GHSA-xh5w-g8gq-r3v9· CVE-2025-13609, PYSEC-2025-77Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices
Modified: 5/29/2026
—PyPI
PYSEC-2022-184· CVE-2022-1053, GHSA-jf66-3q76-h5p5Modified: 5/5/2026
—PyPI
PYSEC-2022-42995· CVE-2022-3500, GHSA-hff2-x2j9-gxgvModified: 6/10/2026
LOW2.8PyPI
PYSEC-2023-128· CVE-2023-3674, GHSA-g4wg-cfpf-9689Modified: 6/10/2026
MEDIUM6.5PyPI
PYSEC-2023-160· CVE-2023-38201, GHSA-f4r5-q63f-gcwwModified: 11/8/2023
HIGH8.2PyPI
PYSEC-2025-77· CVE-2025-13609, GHSA-xh5w-g8gq-r3v9Modified: 6/10/2026
MEDIUM4.3PyPI
PYSEC-2026-1488· CVE-2025-1057, GHSA-9jxq-5x44-gx23Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1489· CVE-2023-38200, GHSA-pg75-v6fp-8q59Keylime's registrar vulnerable to Denial-of-service attack via a single open connection
Modified: 7/7/2026
MEDIUM6.3PyPI
PYSEC-2026-2548· CVE-2026-6420, GHSA-q8w6-w55c-ccv5Keylime has a hardcoded attestation challenge nonce that allows replay attacks
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-74· CVE-2026-1709, GHSA-4jqp-9qjv-57m2Modified: 6/10/2026