CVE-2026-109141High· 8.4▾ TwilightThe vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Krill (all versions)This issue is fixed in 0.16.1 and all later versions.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109142High· 8.4Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
CVE-2026-109140High· 8.4Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token
CVE-2026-72755Low· 3.8Routinator stores TA certificate in cache without validation
CVE-2026-72753High· 8.2Routinator incorrectly handles delta updates
CVE-2026-72756High· 7.5Routinator exits on malformed rsync URIs
CVE-2026-72754High· 7.5Routinator exits when parsing an incorrect or very large CRL file