NLnet Labs Krill weak hash

Summaryinfo

A vulnerability, which was classified as problematic, has been found in NLnet Labs Krill. This affects an unknown function. The manipulation leads to weak hash. This vulnerability is traded as CVE-2026-109140. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in NLnet Labs Krill (affected version unknown) and classified as problematic. This issue affects an unknown functionality. The manipulation with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

It is possible to read the advisory at nlnetlabs.nl. The identification of this vulnerability is CVE-2026-109140 since 10/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• NLnet Labs

Name

• Krill

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion