Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

Summary

When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.

Remediation

1. Inventory every NLnet Labs Krill deployment, including staging.
2. Upgrade NLnet Labs Krill to 0.16.1.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt