{"affected":[{"defaultStatus":"affected","product":"Krill","source":"CNA: NLnet Labs","vendor":"NLnet Labs","versions":[{"lessThan":"*","status":"unaffected","version":"0.16.1","versionType":"semver"}]}],"cveId":"CVE-2026-109142","cwes":["CWE-639"],"description":"When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: NLnet Labs","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},{"score":8.4,"severity":"high","source":"NVD: sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1793639854987,"publishedAt":1793634133364,"references":[{"source":"CNA: NLnet Labs","tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt"},{"source":"sep@nlnetlabs.nl","tags":[],"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt"}],"remediation":[{"kind":"fix","source":"CNA: NLnet Labs","text":"This issue is fixed in 0.16.1 and all later versions."}],"revision":"4df66008292001002c57609fd710a677e72c52dcd17546ac115c530d28a54ac3","sources":[{"modifiedAt":1793635856242,"name":"CNA: NLnet Labs","retrievedAt":1793639322630,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109142"},{"modifiedAt":1793639854987,"name":"NVD","retrievedAt":1793643557781,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109142"}],"ssvc":{"assessedAt":1793635847154,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Krill treats a \"local parent\" as already-authenticated, letting a CA operator act as any child of any CA on the same server","updatedAt":1793643557781}