CVE-2026-109142
Received Received - Intake

Krill CA Parent-Child Identity Spoofing Vulnerability

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: NLnet Labs

Description
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-109142

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nlnetlabs krill to 0.16.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a CA (Certificate Authority) parent server running on the same Krill server as its child CA. Instead of properly verifying a signed CMS message during an RFC 6492 provisioning exchange, the parent server trusts the child identity provided by the caller without validating if it actually belongs to the requesting CA.

Detection Guidance

This vulnerability involves improper identity verification in Krill's RFC 6492 provisioning exchange when a parent CA resides on the same server. Detection requires checking Krill server logs for in-process provisioning exchanges without proper CMS message verification. Look for entries where child_handle is trusted without validation. No direct commands are provided, but monitor logs for unexpected parent-child CA interactions on the same server.

Impact Analysis

An attacker could exploit this to impersonate a legitimate child CA and issue unauthorized certificates by manipulating the child identity in the provisioning request. This could lead to certificate spoofing, man-in-the-middle attacks, or unauthorized access to systems trusting these certificates.

Compliance Impact

This vulnerability allows unauthorized CA identity manipulation, potentially leading to data integrity breaches. GDPR requires data integrity and security; HIPAA mandates strict access controls. Exploitation could violate these by enabling unauthorized certificate issuance or data access.

Mitigation Strategies

Update Krill to the latest patched version to address the in-process RFC 6492 provisioning exchange flaw. Ensure parent and child CAs do not reside on the same Krill server to prevent identity spoofing. Review CA contact configurations for unauthorized child identities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...