Description
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
Published: 2026-11-02
Score: 8.4 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

This issue is fixed in 0.16.1 and all later versions.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 16:00:00 +0000

Type Values Removed Values Added
Description When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
Title Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-11-02T16:10:56.242Z

Reserved: 2026-10-12T11:22:34.614Z

Link: CVE-2026-109142

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T16:17:27.267

Modified: 2026-11-02T16:17:27.267

Link: CVE-2026-109142

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key