Keylime registrar: a rogue agent can claim an existing agent's UUID and overwrite its attestation identity

Impact

Keylime is the attestation service many operators use to prove that a node booted the expected firmware and kernel before it is allowed to join the fleet or receive secrets. An attacker who can register an agent is able to re-register an existing agent's UUID with a different TPM, overwriting the legitimate node's recorded identity. From then on attestation results for that UUID describe the attacker's machine, so a tampered or untrusted GPU node can keep showing as attested while the real node's state is no longer being measured. Where attestation gates key release or admission, this turns the control that was supposed to catch a compromised node into a control that endorses one. Red Hat rates it 8.2 and notes the scope change: the damage lands outside keylime, in whatever trusts its verdict.

Who can reach it

Network reach to the keylime registrar plus the ability to run the registration flow - the CVSS vector records high privileges required (PR:H), so this is an actor who already holds agent-level credentials or control of a registered host, not an anonymous caller.

What to do

Update keylime from the distribution: Red Hat shipped fixes in RHSA-2025:23201, 23210, 23628, 23735 and 23852 for RHEL 9 and 10 streams. Cost is a package update plus a restart of the registrar and verifier services - no node drain and no reboot. After updating, review the registrar database for duplicate or recently changed UUID-to-AIK bindings, since a successful overwrite leaves a legitimate agent recorded against the wrong TPM.

References

Related entries

• VMware Aria Automation (DOM-based XSS, token theft): A crafted URL steals the access token of a logged-in AriaCVE-2025-22249 · VMware Aria Automation (DOM-based XSS, token theft)High
• OpenShift Hive / MCE / ACM (vCenter credential exposure): vCenter credentials are written into the ClusterProvisionCVE-2025-2241 · OpenShift Hive / MCE / ACM (vCenter credential exposure)High
• Jenkins (Git Parameter plugin): Git parameter value is not validated against the offered choicesCVE-2025-53652 · Jenkins (Git Parameter plugin)High
• Foreman: command injection in the errors:fetch_log rake task escalates a scoped sudo grant to full code executionCVE-2026-12540 · Foreman / Red Hat Satellite (foreman-rake errors:fetch_log task)High
• Foreman / Red Hat Satellite: shell injection via foreman-rake db:dump and db:import_dump pathsCVE-2026-12541 · Foreman / Red Hat Satellite (foreman-rake db:dump and db:import_dump tasks)High
• GitLab: raw-file cache poisoning makes targeted CI/CD pipelines execute attacker contentCVE-2026-14814 · GitLab CE/EE (raw repository file response cache, repository reference validation)High