CVE-2026-109142: fallo de gravedad alta en NLnet Labs Krill
Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.4epss 0.3%
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Productos afectados
NLnet Labs · KrillCVEs relacionadas — NLnet Labs Krill
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-0158HIGHTriggered crash on direct RRDP accessEPSS 0.7%CVE-2026-109140HIGHKrill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" tokenEPSS 0.3%CVE-2026-109141HIGHKrill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk importEPSS 0.3%