PT-2026-135499
CVE-2026-109142
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
8.4
HighMetricsAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
Found an issue in the description? Have something to add? Feel free to write us 👾