PYSEC-2026-1488: Keylime: keylime registrar dos due to incompatible database entry handling
A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this failure?
Deployments whose registrar database contains agent registration entries created by an older Keylime version, such as 7.11.0, are exposed after using version 7.12.0. The incompatibility arises because older entries are stored as bytes while the updated registrar expects strings.
What triggers the denial of service?
The failure is triggered when the updated registrar processes an agent registration request and attempts to read an incompatible older database entry. The resulting exception causes the agent to fail.
Does exploitation require authentication or special privileges?
No privileges or authentication are indicated by the supplied vector, but user interaction is required. The available information does not specify the exact interaction or request path needed to trigger processing of the incompatible entry.