{"id":"CVE-2026-109142","kind":"vulnerability","aliases":["CVE-2026-109142"],"related":[],"title":"Krill: a CA operator can act as any child CA when the parent is on the same Krill server","description":"When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.","summary":"When a certificate authority's parent runs on the same Krill server, Krill skips signed CMS verification and trusts the child_handle the caller supplies in the parent contact. The sources do not say what an attacker gets beyond acting as an arbitrary child CA in the RPKI provisioning exchange.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","krill","rpki","self-hosted"],"not_affected_if":["separate-servers","signed-cms-exchange-only"],"how_to_check":"Unknown until NLnet Labs publishes versions. Check whether any CA on your Krill server has a parent that is another CA on the same server (krillc parents statuses --ca <handle>, or krillc parents contact); if so, treat it as exposed. Also check which users can create or edit CAs on the server.","fix":null,"status":"open","published_at":"2026-11-02T16:17:27+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:26+00:00","updated_at":"2026-11-02T16:31:05+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T16:26:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Krill: same-server CA provisioning trusts a caller-supplied child identity","impact":"high","summary":"When a certificate authority's parent runs on the same Krill server, Krill skips signed CMS verification and trusts the child_handle the caller supplies in the parent contact. The sources do not say what an attacker gets beyond acting as an arbitrary child CA in the RPKI provisioning exchange.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["krill","rpki","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; attacker can impersonate an arbitrary child CA identity","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109142 for affected Krill versions, fixed version, and attack vector, since the sources only give the description and CVSS 8.4.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["separate-servers","signed-cms-exchange-only"],"who_is_affected":"Operators running Krill with a parent CA and a child CA hosted on the same Krill server are the exposed case, since the in-process exchange path is the one that skips verification. Krill deployments where parent and child run on separate servers and exchange signed CMS messages are not described as affected. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4128,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109142 for affected Krill versions, fixed version, and attack vector, since the sources only give the description and CVSS 8.4.","search":"'-109142':22A,25A '-2026':21A,24A '6492':106C 'act':6A,71B 'actual':133C 'arbitrari':74B 'attack':68B 'author':35B 'belong':134C 'beyond':70B 'build':95C 'ca':3A,10A,76B,84C,137C 'caller':55B,121C 'certif':34B 'check':128C 'child':9A,52B,75B,115C,117C,131C 'cms':47B,100C 'contact':60B,126C 'cve':20A,23A 'exchang':81B,108C 'get':69B 'handl':53B,118C 'host':31B 'ident':116C,132C 'in-process':109C 'infrastructur':26B 'instead':93C 'krill':1A,18A,27B,42B,44B,91C 'live':87C 'make':138C 'messag':101C 'noth':127C 'oper':4A 'parent':13A,37B,59B,86C,125C 'process':111C 'provis':80B,107C 'put':122C 'request':140C 'rfc':105C 'rpki':28B,79B 'run':38B,103C 'say':65B 'self':30B 'self-host':29B 'server':19A,43B,92C 'sign':46B,99C 'skip':45B 'sourc':62B 'suppli':56B 'trust':50B,113C 'verif':48B 'verifi':97C","nicknames":[],"mitigations":[],"who_affected":"Operators of a Krill RPKI server where a CA's parent is another CA on the same server. A user who can configure a CA there can supply any child_handle in the parent contact, and Krill does not verify it, so they can act as any child of any CA on that server (per the CVE description). Setups where parent and child run on separate servers and use signed CMS messages are not described as affected. Affected versions and a fix are not stated in the sources I could read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","krill","rpki","selfhosted"],"first_public_at":"2026-11-02T16:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109142","severity":null,"published_at":"2026-11-02T16:17:27+00:00","modified_at":"2026-11-02T16:17:27+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109142:1401","url":null,"severity":null,"published_at":"2026-11-02T16:31:05+00:00","modified_at":"2026-11-02T16:31:05+00:00","first_seen_at":"2026-11-02T16:31:05+00:00","fetched_at":"2026-11-02T16:31:05+00:00","note":"No NLnet Labs advisory or fixed release found yet (advisories page lists only CVE-2023-0158; latest release v0.16.0 of 2026-03-03 changelog does not mention it; NVD page not fetchable, only the description via vulners). CNA is sep@nlnetlabs.nl, CVSS vector AV:N/AC:H/PR:L/S:C. Affected versions and fix unknown; recheck NLnet Labs Krill advisories and GitHub releases."}],"documents":[{"id":52876,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109142","title":"NVD: CVE-2026-109142","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}