CVE-2026-109142High· 8.4▾ TwilightWhen a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the pare…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
Krill (all versions)This issue is fixed in 0.16.1 and all later versions.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109141High· 8.4Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
CVE-2026-109140High· 8.4Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token
CVE-2026-72755Low· 3.8Routinator stores TA certificate in cache without validation
CVE-2026-72753High· 8.2Routinator incorrectly handles delta updates
CVE-2026-72756High· 7.5Routinator exits on malformed rsync URIs
CVE-2026-72754High· 7.5Routinator exits when parsing an incorrect or very large CRL file