Vulnerability · Published Nov 2, 2026 · Assigned by NLnet Labs
CVE-2026-109140Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token
High 8.4
In plain English
A high-severity security flaw in Krill from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.3%top 76.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NLnet Labs | Krill | see references |
Weakness: CWE-323 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
References
- https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt vendor-advisory