---
id: "CVE-2026-109142"
kind: "vulnerability"
aliases: ["CVE-2026-109142"]
title: "Krill: a CA operator can act as any child CA when the parent is on the same Krill server"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "krill", "rpki", "self-hosted"]
not_affected_if: ["separate-servers", "signed-cms-exchange-only"]
published_at: "2026-11-02T16:17:27+00:00"
first_seen_at: "2026-11-02T16:24:04+00:00"
updated_at: "2026-11-02T16:31:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109142", "first_seen_at": "2026-11-02T16:24:04+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:31:05+00:00"}]
---

# Krill: a CA operator can act as any child CA when the parent is on the same Krill server

When a certificate authority's parent runs on the same Krill server, Krill skips signed CMS verification and trusts the child_handle the caller supplies in the parent contact. The sources do not say what an attacker gets beyond acting as an arbitrary child CA in the RPKI provisioning exchange.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until NLnet Labs publishes versions. Check whether any CA on your Krill server has a parent that is another CA on the same server (krillc parents statuses --ca <handle>, or krillc parents contact); if so, treat it as exposed. Also check which users can create or edit CAs on the server.

## Timeline

- 2026-11-02T16:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109142
- 2026-11-02T16:31:05+00:00 analyst — No NLnet Labs advisory or fixed release found yet (advisories page lists only CVE-2023-0158; latest release v0.16.0 of 2026-03-03 changelog does not mention it; NVD page not fetchable, only the description via vulners). CNA is sep@nlnetlabs.nl, CVSS vector AV:N/AC:H/PR:L/S:C. Affected versions and fix unknown; recheck NLnet Labs Krill advisories and GitHub releases.

## Documents

- [describes] NVD: CVE-2026-109142 https://nvd.nist.gov/vuln/detail/CVE-2026-109142

## From the sources

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_