Vulnerability · Published Nov 2, 2026 · Assigned by NLnet Labs

CVE-2026-109141Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

High 8.4

In plain English

A high-severity authorization bypass via user-controlled key in Krill from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.3%top 79.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request

Affected products (as reported)

Vendor	Product	Versions
NLnet Labs	Krill	see references

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

References

https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt vendor-advisory