CVE-2026-109141: High severity vulnerability

Published Nov 2, 2026

Updated

The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request

Event History

Nov 2, 2026

CVE Published

via NVD·04:17 PM

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are exposed to this issue?

Users assigned a role restricted to a specific list of CAs are affected when they make requests that are not tied to a CA. Those requests receive the role's full permission set rather than the intended CA-scoped restrictions.

What does an attacker need to exploit it?

An attacker needs access through a role configured with a CA restriction list and must be able to submit a request that is not tied to a CA. The bulk CA import endpoint, POST /api/v1/bulk/cas/import, is specifically identified as affected.

What evidence should administrators look for?

Review CA and ROA activity for unexpected child CAs created under existing CAs, unexpected resource assignments to child CAs, and ROAs created through bulk import requests. These actions may indicate that CA-scoped permissions were bypassed.

CVE-2026-109141: High severity vulnerability

Event History

Frequently Asked Questions

Which users are exposed to this issue?

What does an attacker need to exploit it?

What evidence should administrators look for?

Company

Resources

Contact

Frequently Asked Questions

Which users are exposed to this issue?

What does an attacker need to exploit it?

What evidence should administrators look for?