Origin-Validation Error in FORT Validator by NICMx

CVE-2026-53499

What is CVE-2026-53499?

FORT Validator, a Resource Public Key Infrastructure (RPKI) relying-party validator by NICMx, contains an origin-validation error in the RRDP processing for versions through 1.6.7. This flaw allows a delegated Certificate Authority (CA) under the same Trust Anchor Locator (TAL) to utilize a victim CA's public RRDP notification and snapshot URLs. As a result, the validator's URL-based download cache may falsely report success after removing the victim's local snapshot. This vulnerability can lead to the unintentional deletion of the victim's Validated Route Policy (VRPs) and other signed objects from the output of FORT Validator after a scheduled update from the victim. An affected user may face severe risks associated with route hijacking or loss of network reachability. To mitigate the risks, it is advisable to upgrade to version 1.6.8, which contains a fix rejecting cross-origin RRDP snapshots and delta URLs. Administrators can also temporarily disable HTTP/RRDP while maintaining rsync, although this may lead to stale data if rsync is not utilized.

References