# CVE-2025-13609: Keylime identity takeover via duplicate UUID registration in Registrar

Source: https://junglewise.ai/threats/cve-2025-13609-keylime-identity-takeover-via-duplicate-uuid-registration-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-24. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-13609 · Severity: high · CVSS 8.2 · Published 2025-11-24

Keylime is a security tool used to verify the integrity of remote computers and cloud servers using hardware-based trust. A vulnerability in its registration component allows an attacker to register a malicious device using the identity of an existing, legitimate server. This allows the attacker to impersonate trusted systems, potentially bypassing security controls and gaining unauthorized access to sensitive environments.

Technologies: [keylime (PyPI)](https://junglewise.ai/threats/technologies/keylime), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-13609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13609 being exploited in the wild.

**How severe is CVE-2025-13609?** High severity, with a CVSS score of 8.2, published 24 November 2025.

**Which products and versions are affected?** keylime (PyPI) < 7.13.0, ECOSYSTEM:introduced=0,fixed=7.13.0; Red Hat Enterprise Linux 10 < 7.12.1-11.el10_1.3; Red Hat Enterprise Linux 9 < 7.12.1-11.el9_7.3.

**Is there a fix for CVE-2025-13609?** Yes. keylime (PyPI): upgrade to 7.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13609 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-13609?** Check whether you run keylime (PyPI), Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keylime (PyPI): upgrade to 7.13.0 or later

  ```sh
  pip install "keylime>=7.13.0"
  ```


## Technical details

A vulnerability classified as CWE-694 (Use of Multiple Resources with Duplicate Identifier) exists in the Keylime Registrar. An attacker with sufficient privileges can register a new agent using a different Trusted Platform Module (TPM) device while claiming the Universally Unique Identifier (UUID) of an existing, legitimate agent. The Registrar fails to properly validate the uniqueness of the UUID against the associated TPM identity, allowing the attacker to overwrite the legitimate agent's record. This enables the attacker to impersonate the compromised agent during attestation processes and bypass security controls. The issue is addressed in Keylime version 7.14.0 and various Red Hat package updates.

## Affected products

- Keylime Project keylime < 7.14.0
- Red Hat Red Hat Enterprise Linux 9 < 7.12.1-11.el9_7.3
- Red Hat Red Hat Enterprise Linux 10 < 7.12.1-11.el10_1.3

## Identifiers

- CVE-2025-13609
- GHSA-xh5w-g8gq-r3v9
- PYSEC-2025-77

## Timeline

- 2025-11-24: disclosed
- 2025-12-15: patched: Red Hat released security updates for RHEL 9 and 10.

## References

- [https://github.com/keylime/keylime](https://github.com/keylime/keylime)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2025:23201](https://access.redhat.com/errata/RHSA-2025:23201)
- [https://access.redhat.com/errata/RHSA-2025:23210](https://access.redhat.com/errata/RHSA-2025:23210)
- [https://access.redhat.com/errata/RHSA-2025:23628](https://access.redhat.com/errata/RHSA-2025:23628)
- [https://access.redhat.com/errata/RHSA-2025:23735](https://access.redhat.com/errata/RHSA-2025:23735)
- [https://access.redhat.com/errata/RHSA-2025:23852](https://access.redhat.com/errata/RHSA-2025:23852)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)