Live › vulnerability › CVE-2026-109141
A role limited to a list of certificate authorities keeps its full permissions on requests not tied to a CA, including the bulk CA import endpoint. An attacker with that role can add child CAs under any existing CA, grant them resources, and create ROAs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Operators of self-hosted Krill RPKI servers that define a role limited to a list of CAs (cas = [...]). Per the CVE description, that role keeps its full permissions on requests not tied to a CA, such as POST /api/v1/bulk/cas/import, so a holder can add child CAs under any existing CA, give them its resources, and create ROAs. Servers with no CA-restricted roles, or where only fully trusted admins have access, can skip it. Affected versions and a fix are not stated in the sources I could read.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
This page as .md · .json · in your agent: get_signal("CVE-2026-109141")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.