CVE-2026-109141

Summary

A user with a role restricted to specific Certificate Authorities (CAs) can bypass that restriction and perform privileged operations on any CA—including bulk import of ROAs—by sending requests not tied to a specific CA, due to improper authorization enforcement in the API.

Exploitability

Exploitation requires low-privileged authentication (PR:L), high attack complexity (e.g., crafting non-CA-bound requests that trigger elevated permissions), and no user interaction; it is feasible only for authenticated attackers with knowledge of the vulnerable endpoint and request structure.

Blast radius

An attacker could import unauthorized Route Origin Authorizations (ROAs) under any existing CA, enabling large-scale BGP hijacking or traffic redirection across affected networks.

Detection

Look for POST /api/v1/bulk/cas/import requests originating from users whose assigned role is CA-restricted (e.g., listed in a 'cas' array) and not authorized for bulk import operations; such requests should be logged with user identity, endpoint, and role metadata.

Prioritized remediation

Upgrade to version 2.590 or later, where the authorization logic for non-CA-bound requests correctly denies access to the POST /api/v1/bulk/cas/import endpoint for roles restricted to specific CAs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.