CVE-2026-109142
Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
CVSS Score
8.4
EPSS Score
0.0%
EPSS Percentile
0th
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
| CWE | CWE-639 |
| Vendor | nlnet labs |
| Product | krill |
| Published | Nov 2, 2026 |
| Last Updated | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for nlnet labs krill
Be the first to know when new high vulnerabilities affecting nlnet labs krill are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
NLnet Labs / Krill
All versions affected References
Credits
Anthropic and Ada Logics