CVE-2026-109142
High · 8.4CVSS
8.4
EPSS
0.3%
Published
Nov 2, 2026
CISA due date
—
The record
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121734 ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows… CWE-639
- CVE-2026-121732 RosarioSIS before 12.9 contains an improper authorization vulnerability that allows… CWE-639
- CVE-2026-121582 A vulnerability has been found in Umami up to 3.4.1. CWE-639
- CVE-2026-116669 Tanium addressed an improper access controls vulnerability in Discover. CWE-639
- CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the… CWE-639
- CVE-2026-115292 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can… CWE-639
- CVE-2026-115295 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to… CWE-639
- CVE-2026-121560 LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that… CWE-639