CVE-2026-109140: High severity vulnerability

Published Nov 2, 2026

Updated

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

Event History

Nov 2, 2026

CVE Published

via NVD·04:17 PM

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates an attacker needs network access and low privileges. Exploitation has high attack complexity and does not require user interaction.

What security impact is indicated if exploitation succeeds?

The reported impact includes high confidentiality and integrity impact, with low availability impact. The scope is changed, indicating the impact can extend beyond the initially vulnerable security authority.

CVE-2026-109140: High severity vulnerability

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security impact is indicated if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security impact is indicated if exploitation succeeds?