NLnet Labs Krill vulnerabilities and fixes
Exploited and high-severity NLnet Labs Krill vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.4CVE-2026-109141Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk importFix availableNLnet Labs Krill
1 min read - 8.4CVE-2026-109142Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same serverFix availableNLnet Labs Krill
1 min read - 8.4CVE-2026-109140Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" tokenFix availableNLnet Labs Krill
1 min read