CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142

The Krill server is vulnerable to an authorization bypass when a Certificate Authority (CA) and its parent reside on the same server. Instead of verifying a signed CMS message, the system executes the RFC 6492 provisioning exchange in-process and trusts the child_handle provided by the caller in ...