CVE-2026-109140 in Krill
Summary
by MITRE • 11/02/2026
The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
This security flaw represents a critical failure in cryptographic implementation within the KRILL Resource Certificate Authority software, specifically concerning the management of session tokens and encryption nonces. The vulnerability stems from an improper initialization strategy for the counter that generates the nonce used to encrypt login-session data. In secure cryptographic practices, particularly when using modes like AES-GCM or ChaCha20-Poly1305 which rely on unique nonces per key usage, it is imperative that the nonce generation mechanism maintains state across system restarts or utilizes a source of entropy that guarantees uniqueness. However, in this specific implementation, the counter responsible for deriving the nonce is hardcoded to reset to zero every time the KRILL service restarts. This design choice fundamentally violates the principle of non-repeating inputs required for secure symmetric encryption when using deterministic counters without additional safeguards such as sequence number tracking stored persistently on disk or integrated with a high-entropy random source that survives reboots.
The operational impact of this vulnerability is severe, primarily because it enables nonce reuse attacks against encrypted session tokens. When the same key and nonce pair are used to encrypt multiple distinct plaintexts, an attacker who observes the resulting ciphertexts can perform statistical analysis or direct mathematical deduction to recover parts of the plaintext or even the entire message depending on the encryption mode employed. In the context of login-session tokens, this means that an adversary with network visibility or access to stored session data from previous sessions could potentially decrypt these tokens. Since session tokens often contain sensitive authentication credentials and user identity information, their compromise allows for unauthorized access to administrative interfaces and underlying infrastructure management capabilities. This effectively bypasses the intended confidentiality protections provided by the encryption layer, rendering the security controls ineffective against any attacker capable of capturing or accessing historical encrypted data combined with new sessions established after a restart.
From an industry standards perspective, this vulnerability aligns closely with CWE-328: Use of Weak Hash for Passwords if we consider the broader context of weak cryptographic practices, but more accurately it maps to CWE-310: Cryptographic Issues and specifically CWE-759: Use of a One-Way Hash without a Salt or in this case CWE-330: Use of Insufficiently Random Values. The failure lies not necessarily in the choice of algorithm itself but in the violation of its operational constraints regarding nonce uniqueness. Furthermore, within the MITRE ATT&CK framework, this flaw facilitates Initial Access techniques such as Valid Accounts exploitation (T1078) because it allows attackers to forge or decrypt valid session tokens without needing to crack passwords directly. It also relates to Defense Evasion by allowing attackers to maintain persistent access through stolen sessions that appear legitimate due to their cryptographic validity prior to decryption.
Mitigation strategies must focus on ensuring the persistence and uniqueness of nonce generation mechanisms across system lifecycles. The most effective remediation involves modifying the KRILL software to store the current counter value in a secure, non-volatile storage medium such as an encrypted database or file that persists independently of the application process lifecycle. Alternatively, the implementation should switch to using cryptographically secure random number generators for nonce creation if the encryption mode permits it, ensuring that even after a restart, the probability of generating a duplicate nonce is negligible. Additionally, implementing key rotation policies can limit the window of exposure; by frequently changing the encryption keys used for session tokens, the amount of ciphertext available for analysis under any single (key, nonce) pair is reduced. Organizations relying on KRILL should apply vendor-provided patches that address this state management issue and verify that their deployment configurations do not inadvertently reset cryptographic states during routine maintenance or updates.