CVE-2026-109142High 8.4Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server0.3%
CVE-2026-109141High 8.4Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import0.3%
CVE-2026-109140High 8.4Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token0.3%
CVE-2023-0158High 7.5Triggered crash on direct RRDP access0.7%