Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token

Summary

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

Remediation

1. Inventory every NLnet Labs Krill deployment, including staging.
2. Upgrade NLnet Labs Krill to 0.16.1.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt