The CVE number for this vulnerability is CVE-2026-109142.

== Summary
Krill treats a "local parent" as already-authenticated, letting a CA
operator act as any child of any CA on the same server

== Affected products
Krill up to and including 0.16.0.

== Description
When a CA's parent lives on the same Krill server: instead of building
and verifying a signed CMS message, it runs the RFC 6492 provisioning
exchange in-process and trusts the child identity (child_handle) that the
caller put in the parent contact. Nothing checks that this child identity
actually belongs to the CA making the request.

== Solution
Install Krill 0.16.1 or later.

== Acknowledgments
We would like to thank Anthropic and Ada Logics for finding the vulnerability.