CVE-2026-109141 Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

The vulnerability gives a role that is restricted to a list of CAs cas = ... its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resource...