Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

Summary

The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request

Remediation

1. Inventory every NLnet Labs Krill deployment, including staging.
2. Upgrade NLnet Labs Krill to 0.16.1.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt