{"id":"CVE-2026-109142","published":"2026-11-02T16:17:27.267","lastModified":"2026-11-02T19:35:33.347","description":"When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an authenticated attacker with low privileges to impersonate any child CA by injecting a forged child_handle into a parent contact during an in-process provisioning exchange, bypassing identity verification entirely.","exploitability":"Exploitation requires valid authentication as a CA with access to the Krill server's parent-child provisioning endpoint and knowledge of a target child_handle to inject; high attack complexity due to the need for precise manipulation.","blast_radius":"Successful exploitation enables full compromise of the targeted CA's identity, allowing unauthorized certificate issuance, revocation, or misrepresentation under the victim CA's name within the RPKI ecosystem.","remediation":"Upgrade to Krill version 2.590 or later, which enforces strict validation of child_handle ownership against the requesting CA's registered identity before accepting in-process provisioning requests.","detection":"Monitor Krill server logs for provisioning requests where the child_handle in the parent contact does not match the authenticated CA's registered child identifiers; look for entries with 'provisioning' or 'parent_contact' containing unexpected child handles.","tags":["rpki","identity-bypass","insecure-provisioning","ca-compromise","krill"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:01:54.827Z"}}