PT-2026-135498
CVE-2026-109141
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
8.4
HighMetricsAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
Found an issue in the description? Have something to add? Feel free to write us 👾