{"id":"CVE-2026-109142","title":"Krill treats a \"local parent\" as already-authenticated, letting a CA operator act as any child of any CA on the same server","summary":"When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the pare…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"NLnet Labs","product":"Krill","affected":["Krill (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-02T16:10:47.154411Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T16:10:56.242Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109142","references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt"}],"tags":["cve.org"],"epss":0.00276,"epssPercentile":0.20152,"ingestedAt":"2026-11-05T19:30:42.704Z","slug":"CVE-2026-109142","body":"## Overview\n\nWhen a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.\n\n## Affected\n\n- `Krill (all versions)`\n\n## Remediation\n\nThis issue is fixed in 0.16.1 and all later versions.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}