Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109142— Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

Quick assessment

Affected
NLnet Labs Krill
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当证书颁发机构（CA）的父级位于同一 Krill 服务器上时：系统不会构建并验证已签名的 CMS 消息，而是在进程内执行 RFC 6492 规定的配置交换流程，并直接信任调用方在父级联系人信息中提供的子级标识（child_handle）。然而，没有任何机制验证该子级标识是否确实属于发起请求的 CA。

CVSS 8.4 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109142

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
Source: CVE Program / CVE List V5
Vulnerability Description
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NLnet Labs Krill 0.16.1 ~ * -

II. Public POCs for CVE-2026-109142

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109142

请登录查看更多情报信息。

Other References for CVE-2026-109142 (1)

Same Patch Batch · NLnet Labs · 2026-11-02 · 3 CVEs total

CVE-2026-109141 8.4 HIGH Krill users restricted to one CA can make any other CA delegate its prefixes and publish R
CVE-2026-109140 8.4 HIGH Krill login-session tokens reuse their encryption nonce across restarts, so any user who c

IV. Related Vulnerabilities

Same product: Krill
Same vendor: NLnet Labs
Same weakness: CWE-639