CVE-2026-109142: High severity vulnerability

Published Nov 2, 2026

Updated

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (childhandle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.

Event History

Nov 2, 2026

CVE Published

via NVD·04:17 PM

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue applies when a CA's parent is hosted on the same Krill server, causing the RFC 6492 provisioning exchange to run in-process rather than through a signed CMS message.

What does an attacker need to exploit it?

An attacker needs the ability to make a provisioning request with a parent contact containing a chosen child_handle. The vulnerable in-process path does not verify that the supplied child identity belongs to the CA making the request.

What is the potential impact of successful exploitation?

The published vector indicates high confidentiality and integrity impact, low availability impact, and scope change. Exploitation requires network access, low privileges, and high attack complexity, with no user interaction.

CVE-2026-109142: High severity vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact of successful exploitation?