Vulnerability in Krill Server Affects Certificate Authority Operations by NLnet Labs

CVE-2026-109142

What is CVE-2026-109142?

The Krill Server is susceptible to a vulnerability where the identity of a Certificate Authority's child may be trusted without proper verification. When a child identity is processed by the server, it does not ensure that this identity corresponds to the genuine CA making the request. This flaw emerges when a CA’s parent operates on the same server, as the server erroneously runs the provisioning exchange in-process instead of correctly building and verifying a signed CMS message. Consequently, this may lead to unauthorized access or manipulation of the CA's trusted identities, putting the security of the cryptographic operations at risk.

References