CVE-2026-109141 in Krill
Summary
by MITRE • 11/02/2026
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The identified vulnerability represents a critical authorization bypass within a Certificate Authority management system, specifically affecting roles configured with restricted permissions tied to specific Certification Authorities. In secure systems, role-based access control is designed to limit user actions to predefined scopes, ensuring that users can only interact with resources explicitly assigned to them. However, in this instance, the security logic fails to properly validate resource ownership when a request does not specify an associated CA identifier. This oversight allows any action performed under such a restricted role to default to full permission sets rather than remaining constrained by the intended scope. Consequently, users who should be limited to managing only specific CAs are granted unrestricted administrative capabilities for operations that lack explicit CA context.
This flaw is particularly severe because it directly impacts the bulk import endpoint located at POST /api/v1/bulk/cas/import. This API endpoint typically handles high-volume configuration changes and resource provisioning, making it a prime target for exploitation due to its elevated privileges and batch processing nature. By exploiting this authorization bypass, an attacker with access to the restricted role can perform actions that are strictly prohibited by policy. Specifically, the vulnerability allows the creation of new child CAs under any existing CA in the hierarchy, regardless of whether the user has permission over those parent entities. This effectively breaks the hierarchical trust model and allows unauthorized delegation of signing authority across the entire infrastructure.
The operational impact extends beyond mere administrative privilege escalation to include significant risks related to resource hijacking and cryptographic integrity. The vulnerability permits the attacker to assign any resources belonging to existing CAs to newly created child CAs, thereby diverting assets such as IP address blocks or AS numbers from their legitimate owners. Furthermore, the ability to create Route Origin Authorizations (ROAs) based on request parameters allows an adversary to manipulate routing security policies defined in Resource Public Key Infrastructure systems. This can lead to route hijacking scenarios where traffic intended for a specific network is redirected through malicious infrastructure, facilitating man-in-the-middle attacks or service disruption without detection by standard monitoring tools that rely on ROA validity checks.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The failure to enforce role-based constraints based on resource context indicates a fundamental flaw in the access control logic. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK techniques involving privilege escalation and lateral movement within cloud or infrastructure environments. Attackers can leverage these capabilities to establish persistent backdoors by creating rogue CAs that sign malicious certificates, thereby gaining trust from clients who validate certificate chains against the compromised hierarchy.
Mitigation strategies must focus on hardening the authorization logic for all API endpoints, particularly those handling bulk operations and resource creation. Developers should implement strict context-aware access control checks that verify not only the user's role but also their specific permissions relative to the target resources involved in each request. It is essential to ensure that actions like creating child CAs or modifying ROAs are explicitly gated by ownership verification mechanisms, preventing users from acting on entities outside their designated scope. Additionally, implementing comprehensive audit logging for all CA management operations can aid in detecting unauthorized attempts and facilitating rapid incident response. Regular security code reviews focusing on authorization boundaries and input validation will further reduce the risk of similar logic flaws emerging in other parts of the application.