NLnet Labs Krill CVE-2026-109140

The attacker must exploit the specific condition stated in the advisory: Krill builds each login-session token's encryption nonce from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair encrypts multiple tokens after each restart. Concrete prerequisites: (1) low-privilege authenticated access to the Krill login flow to be issued and capture at least one encrypted session token (PR:L); (2) the ability to collect ciphertexts that span one or more restarts, since the nonce reuse only manifests once Krill restarts; and (3) the cryptanalytic effort to leverage the shared keystream to recover or forge token plaintext. Limiting factors that reduce realistic risk below the raw 8.4: exploitation requires authentication (not an anonymous remote attacker), it is high-complexity (AC:H), and it depends on Krill restart events the attacker cannot directly trigger; how the recovered/forged token is weaponized is not detailed in the available sources.

Signals are moderately consistent but incomplete. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L, base 8.4) describes a network-reachable but high-complexity flaw that still requires low-privilege authenticated access, with a scope change reflecting that a compromise of the session-crypto layer can affect other principals in the Krill instance. The core defect is a cryptographic one: a login-session token nonce derived from a counter reset to 0 on every Krill restart, causing (key, nonce) reuse (CWE-323) - a genuine weakness class, not merely a paper-high score. However, the real-world urgency signals are soft: there is no CISA KEV listing, no EPSS probability supplied in the input, and no exploit code or PoC reference provided, so exploitation is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits a serious authentication-integrity bug that is nonetheless gated by AC:H and authentication. Net: treat as a real, patch-this-week priority for anyone running Krill, but note the absence of EPSS/KEV/PoC means there is no evidence of active or imminent widespread exploitation - the AC:H gating (dependence on restarts and cross-restart ciphertext capture) makes opportunistic mass exploitation unlikely. The mechanism (nonce reuse on restart) is confirmed by the description; the exact exploitation path to token recovery/forgery is not spelled out in the available sources.

A low-privileged authenticated user of a Krill instance captures the encrypted login-session tokens it is issued, then waits for (or observes) a Krill restart, after which the nonce counter resets to 0 and the same key/nonce keystream is reused to encrypt further tokens. By combining ciphertexts that share the reused keystream, the attacker aims to recover session-token plaintext or forge a token for a higher-privileged session. Exploitation is remote (AV:N) but high-complexity (AC:H) and depends on a restart the attacker does not control; no public exploit code was identified in the provided data.