Role Permission Escalation in NLnet Labs’ Krill Software
CVE-2026-109141

8.4HIGH

Key Information:

Vendor

Nlnet Labs

Status
Krill
Vendor
CVE Published:
2 November 2026

What is CVE-2026-109141?

This vulnerability in NLnet Labs' Krill software permits a role with restricted access to gain full permissions on requests that are not linked to a Certificate Authority (CA). Specifically, it affects the bulk import endpoint, allowing unauthorized addition of child CAs under any existing CA. As a result, the child CA inherits resources from its parent, creating potential security risks and integrity concerns related to route origin authorizations (ROAs) issued in the requests.

Affected Version(s)

Krill 0.16.1

References

https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic and Ada Logics
.