{"id":"CVE-2026-109141","title":"Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import","summary":"The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA …","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"NLnet Labs","product":"Krill","affected":["Krill (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-02T16:11:12.422396Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T16:11:53.977Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109141","references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt"}],"tags":["cve.org"],"epss":0.00276,"epssPercentile":0.20152,"ingestedAt":"2026-11-05T19:30:42.704Z","slug":"CVE-2026-109141","body":"## Overview\n\nThe vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request\n\n## Affected\n\n- `Krill (all versions)`\n\n## Remediation\n\nThis issue is fixed in 0.16.1 and all later versions.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}