Description
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Published: 2026-11-02
Score: 8.4 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

This issue is fixed in 0.16.1 and all later versions.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Title Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-11-02T16:11:53.977Z

Reserved: 2026-10-12T11:22:34.614Z

Link: CVE-2026-109141

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T16:17:27.120

Modified: 2026-11-02T16:17:27.120

Link: CVE-2026-109141

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key