CVE-2026-109142

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109140

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142 Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142

The Krill server is vulnerable to an authorization bypass when a Certificate Authority (CA) and its parent reside on the same server. Instead of verifying a signed CMS message, the system executes the RFC 6492 provisioning exchange in-process and trusts the child_handle provided by the caller in ...

EUVD-2026-115257

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109141 Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...

CVE-2026-109141 Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...

CVE-2026-109141

The Krill software is affected by a vulnerability where a role restricted to a specific list of CAs can gain full permissions for requests not tied to a CA. Specifically, this affects the bulk import endpoint POST /api/v1/bulk/cas/import, allowing an attacker to add a new child CA under any exist...

CVE-2026-109140 Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

CVE-2026-109140

The Krill software is vulnerable to a nonce reuse issue during encryption. Specifically, it encrypts login-session tokens using a nonce generated from a counter that resets to 0 upon every restart. This causes the application to reuse the same (key, nonce) pair after each reboot. Consequently, an...

CVE-2026-109140 Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

EUVD-2026-115255

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

PT-2026-135497

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

PT-2026-135499

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity child handle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109142: NLnet Labs Krill: When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the…

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity childhandle that the caller put in the parent contact. Nothing checks that this child identity actually...

CVE-2026-109140: NLnet Labs Krill: The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0…

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...

CVE-2026-109141: NLnet Labs Krill: The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every…

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...

Malicious code in liberal-apricot-krill (npm)

Source: amazon-inspector ddba2e27f104eeee2d621a20247beddf762809fda8d247e37a45d8a7a77debf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exceptional-black-krill (npm)

Source: amazon-inspector 0e621424dfdc579948ca2968cdf3fcd6617c5738a0f9bb36203005733785f7c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...