CVE-2026-109140 Details
Description
The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
A vulnerability in Krill login-session token encryption allows for the reuse of nonces, leading to potential token forgery. This issue arises because the nonce, derived from a counter, is reset to zero with each Krill restart. Consequently, the same key and nonce pair can be reused after a restart, creating a window of opportunity for exploitation. This vulnerability affects Krill versions through 0.16.0.
Users are advised to upgrade to Krill version 0.16.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-323 | Reusing a Nonce, Key Pair in Encryption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NLnet Labs Krill | <= 0.16.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |