{"affected":[{"defaultStatus":"affected","product":"Krill","source":"CNA: NLnet Labs","vendor":"NLnet Labs","versions":[{"lessThan":"*","status":"unaffected","version":"0.16.1","versionType":"semver"}]}],"cveId":"CVE-2026-109141","cwes":["CWE-639"],"description":"The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: NLnet Labs","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},{"score":8.4,"severity":"high","source":"NVD: sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1793639854860,"publishedAt":1793634125616,"references":[{"source":"CNA: NLnet Labs","tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt"},{"source":"sep@nlnetlabs.nl","tags":[],"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt"}],"remediation":[{"kind":"fix","source":"CNA: NLnet Labs","text":"This issue is fixed in 0.16.1 and all later versions."}],"revision":"1f898ce266902f9c01aa086d124de3a752b92b3b6332f467e7a972f0df9456cb","sources":[{"modifiedAt":1793635913977,"name":"CNA: NLnet Labs","retrievedAt":1793639322047,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109141"},{"modifiedAt":1793639854860,"name":"NVD","retrievedAt":1793643557609,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109141"}],"ssvc":{"assessedAt":1793635872422,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import","updatedAt":1793643557609}