CVE-2026-109140

The vulnerability is that Krill encrypts every login-session token with a nonce built from a…

Risk score: 50/100
CVSS: 8.4 v3.1
Published: 2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.4 high

References

https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt

Original description

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

Last activity 2 Nov 2026. Patch Forecast updates every hour.