Krill

4 results · Feed

• High 8.4
  CVE-2026-109142

  Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

  When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing ch…

  NLnet Labs Krill
  Nov 2, 2026
• High 8.4
  CVE-2026-109141

  Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

  The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA,…

  NLnet Labs Krill
  Nov 2, 2026
• High 8.4
  CVE-2026-109140

  Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token

  The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

  NLnet Labs Krill
  Nov 2, 2026
• High 7.5
  CVE-2023-0158

  Triggered crash on direct RRDP access

  NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml"…

  NLnet Labs Krill
  Jan 17, 2023