Live › vulnerability › CVE-2026-109142
When a certificate authority's parent runs on the same Krill server, Krill skips signed CMS verification and trusts the child_handle the caller supplies in the parent contact. The sources do not say what an attacker gets beyond acting as an arbitrary child CA in the RPKI provisioning exchange.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Operators of a Krill RPKI server where a CA's parent is another CA on the same server. A user who can configure a CA there can supply any child_handle in the parent contact, and Krill does not verify it, so they can act as any child of any CA on that server (per the CVE description). Setups where parent and child run on separate servers and use signed CMS messages are not described as affected. Affected versions and a fix are not stated in the sources I could read.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
This page as .md · .json · in your agent: get_signal("CVE-2026-109142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.