The vulnerability occurs when a CA's parent resides on the same Krill server. Instead of building and verifying a signed CMS message, Krill performs the RFC 6492 provisioning exchange in-process and blindly trusts the child identity provided by the caller. Because there is no validation that the child identity actually belongs to the CA making the request, a CA operator can assume the role of any child CA on that server.

Impact applies to Krill installations running any version up to and including 0.16.0, as the issue is resolved in release 0.16.1 and later. The flaw affects all configurations where parent and child CAs coexist on the same host, regardless of operating system or architecture.

The CVSS score of 8.4 indicates high severity, and the EPSS score is not available, suggesting a low–to‑moderate probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker who can act as a CA operator can impersonate any child CA on the same server, enabling unauthorized certificate issuance or administrative actions. The attack vector is likely local or requires authenticated CA‑operator access to the Krill server.