CVE-2026-109141
HighCVSS 8.4Summary
A role restricted to a list of CAs (cas = [...]) receives its full permission set for requests not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. This allows adding a new child CA under any existing CA, assigning it any of that CA's resources, and creating the ROAs specified in the request.
Risk Assessment
A user with a restricted role can bypass restrictions and create unauthorized CAs and ROAs, undermining RPKI data integrity. This may result in incorrect route announcements and routing disruptions.
Recommendation
Update Krill to a patched version and review permissions of roles restricted to a CA list. Check logs for unexpected calls to the /api/v1/bulk/cas/import endpoint.
Other vulnerabilities in Krill
See all- CVE-2026-109142High
In Krill, when a parent CA lives on the same server, the RFC 6492 provisioning exchange runs in-process instead of building and verifying a signed CMS message. The child identity (child_handle) supplied by the caller in the parent contact is trusted without verifying that it actually belongs to the requesting CA.
- CVE-2026-109140High
Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every restart, so the same (key, nonce) pair is reused after each restart.
Original NVD description (English source)
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Vulnerability data from NVD (NIST) · CISA KEV · EPSS