{"id":"CVE-2026-109141","published":"2026-11-02T16:17:27.120","lastModified":"2026-11-02T19:35:33.347","description":"The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A user with a role restricted to specific Certificate Authorities (CAs) can bypass that restriction and perform privileged operations on any CA—including bulk import of ROAs—by sending requests not tied to a specific CA, due to improper authorization enforcement in the API.","exploitability":"Exploitation requires low-privileged authentication (PR:L), high attack complexity (e.g., crafting non-CA-bound requests that trigger elevated permissions), and no user interaction; it is feasible only for authenticated attackers with knowledge of the vulnerable endpoint and request structure.","blast_radius":"An attacker could import unauthorized Route Origin Authorizations (ROAs) under any existing CA, enabling large-scale BGP hijacking or traffic redirection across affected networks.","remediation":"Upgrade to version 2.590 or later, where the authorization logic for non-CA-bound requests correctly denies access to the POST /api/v1/bulk/cas/import endpoint for roles restricted to specific CAs.","detection":"Look for POST /api/v1/bulk/cas/import requests originating from users whose assigned role is CA-restricted (e.g., listed in a 'cas' array) and not authorized for bulk import operations; such requests should be logged with user identity, endpoint, and role metadata.","tags":["authorization-bypass","roa-abuse","api-abuse","network-security","ca-privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:01:44.664Z"}}