{"id":"CVE-2026-109141","kind":"vulnerability","aliases":["CVE-2026-109141"],"related":[],"title":"Krill: CA-restricted role gets full permissions on bulk CA import","description":"The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request","summary":"A role limited to a list of certificate authorities keeps its full permissions on requests not tied to a CA, including the bulk CA import endpoint. An attacker with that role can add child CAs under any existing CA, grant them resources, and create ROAs.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authorization","krill","other","rpki","self-hosted"],"not_affected_if":["no-cas-restricted-roles"],"how_to_check":"Affected versions are not yet published. You are exposed if your Krill server's auth config (config file or OpenID Connect role mapping) has a role restricted to specific CAs (cas = [...]) and you give that role to users you do not fully trust. Review which users hold such roles and check server logs for POST /api/v1/bulk/cas/import calls.","fix":null,"status":"open","published_at":"2026-11-02T16:17:27+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:26+00:00","updated_at":"2026-11-02T16:32:49+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-02T16:26:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Krill: CA-restricted role gets full permissions on bulk CA import","impact":"high","summary":"A role limited to a list of certificate authorities keeps its full permissions on requests not tied to a CA, including the bulk CA import endpoint. An attacker with that role can add child CAs under any existing CA, grant them resources, and create ROAs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["krill","rpki","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker alters certificate authority hierarchy and issues route authorizations","analyst_note":"Identify the affected Krill versions and fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109141.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-cas-restricted-roles"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000611,"input_tokens":4140,"output_tokens":394,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected Krill versions and fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109141.","search":"'-109141':15A,18A '-2026':14A,17A '/api/v1/bulk/cas/import':105C 'add':58B,107C 'attack':53B 'author':19B,34B 'bulk':10A,48B,101C 'ca':3A,11A,45B,49B,64B,98C,111C,115C,122C 'ca-restrict':2A 'cas':60B,83C,84C 'certif':33B 'child':59B,110C,118C 'creat':69B,126C 'cve':13A,16A 'endpoint':51B,103C 'everi':90C 'exist':63B,114C 'full':7A,37B,86C 'get':6A 'give':73C,116C 'given':129C 'grant':65B 'host':25B 'import':12A,50B,102C 'includ':46B,99C 'keep':35B 'krill':1A,20B 'limit':28B 'list':31B,81C 'new':109C 'permiss':8A,38B,87C 'post':104C 'request':40B,91C,132C 'resourc':67B,124C 'restrict':4A,78C 'roa':70B,128C 'role':5A,27B,56B,75C 'rpki':22B 'self':24B 'self-host':23B 'set':88C 'tie':42B,95C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Operators of self-hosted Krill RPKI servers that define a role limited to a list of CAs (cas = [...]). Per the CVE description, that role keeps its full permissions on requests not tied to a CA, such as POST /api/v1/bulk/cas/import, so a holder can add child CAs under any existing CA, give them its resources, and create ROAs. Servers with no CA-restricted roles, or where only fully trusted admins have access, can skip it. Affected versions and a fix are not stated in the sources I could read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authorization","high","krill","other","rpki","selfhosted"],"first_public_at":"2026-11-02T16:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109141","severity":null,"published_at":"2026-11-02T16:17:27+00:00","modified_at":"2026-11-02T16:17:27+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109141:1402","url":null,"severity":null,"published_at":"2026-11-02T16:32:49+00:00","modified_at":"2026-11-02T16:32:49+00:00","first_seen_at":"2026-11-02T16:32:49+00:00","fetched_at":"2026-11-02T16:32:49+00:00","note":"NVD page not fetchable; only description via signal. NLnet Labs Krill advisories page has no entry yet, GitHub releases latest is 0.16.0 (2026-03-03) with no mention. Affected versions and fix unknown; recheck advisories page and GitHub releases."}],"documents":[{"id":52877,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109141","title":"NVD: CVE-2026-109141","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":52878,"url":"https://www.nlnetlabs.nl/projects/krill/security-advisories/","title":"NLnet Labs Krill security advisories (no entry for this CVE as of 2026-11-02)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}