Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109141— Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

Quick assessment

Affected
NLnet Labs Krill
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该漏洞导致一个原本仅被限制在特定证书颁发机构（CA）列表（ ）内的角色，对所有未与任何 CA 绑定的请求（包括批量导入端点 ）获得其完整的权限集。该漏洞允许在任意现有 CA 下创建一个新的子 CA，将任意资源授予该子 CA，并根据请求内容创建相应的路由授权（ROA）。

CVSS 8.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109141

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
Source: CVE Program / CVE List V5
Vulnerability Description
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs Krill 0.16.1 ~ * -

II. Public POCs for CVE-2026-109141

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109141

请登录查看更多情报信息。

Other References for CVE-2026-109141 (1)

Same Patch Batch · NLnet Labs · 2026-11-02 · 3 CVEs total

CVE-2026-109142 8.4 HIGH Krill treats a "local parent" as already-authenticated, letting a CA operator act as any c
CVE-2026-109140 8.4 HIGH Krill login-session tokens reuse their encryption nonce across restarts, so any user who c

IV. Related Vulnerabilities

Same product: Krill
Same vendor: NLnet Labs
Same weakness: CWE-639