FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Krill -- multiple vulnerabilities

Affected packages
		krill	<	0.16.1

Details

VuXML ID	07fc222f-d798-11f1-934c-3c7c3fba4204
Discovery	2026-11-02
Entry	2026-11-03

NLnet Labs reports:

CVE-2026-109140: Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token.

CVE-2026-109141: Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import.

CVE-2026-109142: Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server.

[source]

References

CVE Name	CVE-2026-109140
CVE Name	CVE-2026-109141
CVE Name	CVE-2026-109142
URL	https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt
URL	https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt
URL	https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt