Quick answers
- Is CVE-2026-109142 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109142 being exploited in the wild.
- How severe is CVE-2026-109142?
- High severity, with a CVSS score of 8.4, published 2 November 2026.
- Which products and versions are affected?
- NLnet Labs Krill up to and including 0.16.0.
- Is there a fix for CVE-2026-109142?
- Yes: fixed in Krill 0.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-109142 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-109142?
- Check whether you run NLnet Labs Krill at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Krill 0.16.1 or later
Technical details
Krill performs in-process RFC 6492 provisioning exchanges for local parents instead of verifying signed CMS messages, trusting the child_handle supplied by the caller without validating that the requesting CA actually owns that identity. This allows privilege escalation from one CA to another on the same server. The vulnerability affects Krill versions up to and including 0.16.0; no authentication or network-level preconditions are required beyond local server access.
Affected products
- NLnet Labs Krill up to and including 0.16.0
Timeline
- 2026-11-02: disclosed