CVE-2026-109140

Summary

Krill reuses encryption keys and nonces for login-session tokens after each service restart because the nonce counter resets to zero, breaking session confidentiality and integrity.

Exploitability

Exploitation requires network access and knowledge of a prior session token before the restart; it is difficult in practice due to the need to capture tokens pre-restart and replay them post-restart.

Blast radius

An attacker who recovers a reused (key, nonce) pair can decrypt or forge session tokens, potentially gaining unauthorized access to user sessions and compromising confidentiality and integrity of authenticated requests.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Krill version 2.590 or later, which fixes the nonce reset issue by using a persistent counter or cryptographically secure random nonces.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.