CVE-2026-109141: high-severity vulnerability in NLnet Labs Krill
Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.4epss 0.3%
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
NLnet Labs · KrillRelated CVEs — NLnet Labs Krill
In the same product, most dangerous first.
CVE-2023-0158HIGHTriggered crash on direct RRDP accessEPSS 0.7%CVE-2026-109140HIGHKrill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" tokenEPSS 0.3%CVE-2026-109142HIGHKrill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same serverEPSS 0.3%