CVE-2026-53499

Received Received - Intake

FORT Validator Origin Validation Error in RRDP Processing

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

FORT Validator is a Resource Public Key Infrastructure (RPKI) relying-party validator that produces validated route-origin data. FORT Validator versions through 1.6.7 contain an origin-validation error in their RRDP processing: a delegated CA under the same Trust Anchor Locator (TAL) can reference a victim CA’s public RRDP notification and snapshot URLs, causing FORT’s URL-based download cache to report success after deleting the victim’s local snapshot. Following a routine victim publication, this can silently remove the victim’s VRPs and other signed objects from FORT’s output, potentially enabling route hijacking or loss of reachability. Version 1.6.8 contains a patch that rejects cross-origin RRDP snapshot and delta URLs; as a workaround, administrators can disable HTTP/RRDP with --http.enabled=false while keeping rsync enabled, although this can leave data unavailable or stale where rsync is not supported.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53499

Affected Vendors & Products

Vendor	Product	Version / Range
fort	validator	to 1.6.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

FORT Validator versions up to 1.6.7 have an origin-validation error in RRDP processing. A delegated CA under the same Trust Anchor Locator can reference a victim CA's RRDP URLs, causing FORT's cache to report success after deleting the victim's local snapshot. This can silently remove the victim's VRPs and signed objects from FORT's output, potentially enabling route hijacking or loss of reachability.

Detection Guidance

To detect this vulnerability, check if FORT Validator is running version 1.6.7 or earlier. Verify if RRDP is enabled and review logs for unexpected snapshot deletions or cross-origin references. Use commands like 'fort --version' to check the version and 'fort --http.enabled' to confirm RRDP status.

Impact Analysis

This vulnerability can lead to route hijacking or loss of network reachability. Attackers could exploit it to remove valid route-origin data from FORT Validator's output, causing incorrect routing decisions. Systems relying on RPKI validation may accept invalid routes or reject valid ones, disrupting network operations.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling route hijacking or loss of reachability, which may disrupt network integrity and data routing. However, the CVE does not explicitly link this issue to specific compliance requirements.

Mitigation Strategies

Upgrade FORT Validator to version 1.6.8 or later to apply the patch that rejects cross-origin RRDP snapshot and delta URLs. Alternatively, disable HTTP/RRDP with the command --http.enabled=false while keeping rsync enabled, though this may limit data availability.

Hi! I’m here to help you understand CVE-2026-53499. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70