CVE-2026-109140

High

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill…

NLnet Labs·CWE-323·Published 2026-11-02

CVSS

8.4

EPSS

—

KEV

Exploits

Vendor statements (1)

nlnetlabs.nl

cve.orgen

207 chars

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	8.4	—	—	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
3.1	Secondary	ENISA EUVD	8.4	—	—	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
3.1	Secondary	NVD	8.4	1.8	6.0	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L