NLnet Labs Krill CVE-2026-109141

Exploitation requires the attacker to already hold a valid Krill account with a role that is restricted to a list of CAs (cas = [...]); this is the PR:L prerequisite, so it is an authenticated insider or compromised-credential scenario, not remote-unauthenticated. The trigger is any request that is not tied to a specific CA - the description names POST /api/v1/bulk/cas/import as such an endpoint - where the restricted role is incorrectly granted its full permission set. Limiting factors: a provisioned restricted role/credential is required, and the flaw only manifests on CA-agnostic requests; it most meaningfully affects multi-tenant or delegated deployments where roles are deliberately scoped to subsets of CAs.

This is a genuine, high-impact authorization flaw but one whose real-world risk is bounded by an access prerequisite. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L, base 8.4) and CWE-639 (authorization bypass through user-controlled key) agree with the description: an already-authenticated principal escalates beyond its intended scope. Because PR:L is present, exploitation requires a valid Krill account whose role is restricted to a list of CAs - this is an insider / compromised-credential scenario, not anonymous internet exploitation. The scope change (S:C) and C:H/I:H are well-justified because the actor crosses the authorization boundary between distinct CAs in the RPKI hierarchy, able to create child CAs, assign resources, and mint ROAs under any CA. I disagree with the input AC:H: the description presents a deterministic logic flaw (non-CA-scoped requests receive the full permission set) with no attacker-uncontrolled condition, race, or timing described, so AC:L is the honest reading - the trigger mechanism beyond that is not elaborated in the available sources. On exploitation signals: there is no CISA KEV listing and no EPSS score in the input, and the only reference is a vendor advisory, not exploit code - so no active exploitation and no public exploit are indicated. The vuln.today decision label is 'this_week' (prioritize, but not emergency/act_now), consistent with a serious authenticated flaw lacking confirmed in-the-wild use. Net: treat as a real priority for any multi-tenant or delegated Krill deployment, but not a drop-everything emergency, and note the AC and EPSS gaps when ranking.

A Krill user whose role is intentionally restricted to a specific list of CAs sends a request to a CA-agnostic endpoint such as POST /api/v1/bulk/cas/import; because requests not tied to a particular CA are granted the full permission set, the request succeeds. The attacker adds a child CA under any existing CA, assigns it that CA's resources, and creates attacker-chosen ROAs, forging RPKI route authorizations outside their delegation. No public exploit code is identified; only a vendor advisory from NLnet Labs exists.