Skip to content
fr Sign in
8.4 High

CVE-2026-109141 The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every…

Description

The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request

Affected products and versions

Product Affected versions Fixed in
Krill 0.16 earliest → < 0.16.1 0.16.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Krill

The 4 CVEs of Krill →
CVE-2026-109142 When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the… 8.4 High CVE-2026-109140 The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to… 8.4 High CVE-2023-0158 NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp"… 7.5 High
Track this CVE