CVE-2026-109142

Summary

The flaw allows an authenticated attacker with low privileges to impersonate any child CA by injecting a forged child_handle into a parent contact during an in-process provisioning exchange, bypassing identity verification entirely.

Exploitability

Exploitation requires valid authentication as a CA with access to the Krill server's parent-child provisioning endpoint and knowledge of a target child_handle to inject; high attack complexity due to the need for precise manipulation.

Blast radius

Successful exploitation enables full compromise of the targeted CA's identity, allowing unauthorized certificate issuance, revocation, or misrepresentation under the victim CA's name within the RPKI ecosystem.

Detection

Monitor Krill server logs for provisioning requests where the child_handle in the parent contact does not match the authenticated CA's registered child identifiers; look for entries with 'provisioning' or 'parent_contact' containing unexpected child handles.

Prioritized remediation

Upgrade to Krill version 2.590 or later, which enforces strict validation of child_handle ownership against the requesting CA's registered identity before accepting in-process provisioning requests.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.