Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-109140

Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Krill
CVE-2026-109141

Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Krill
CVE-2026-109142

Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Krill
CVE-2023-0158

Triggered crash on direct RRDP access

NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml" as would be expected, causes Krill to crash. If the built-in "/rrdp" endpoint is exposed directly to the internet, then malicious remote parties can cause the publication server to crash. The repository content is not affected by this, but the availability of the server and repository can cause issues if this attack is persistent and is not mitigated.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Krill