CVE-2026-53499

Name of the Vulnerable Software and Affected Versions FORT Validator versions prior to 1.6.8

Description FORT Validator, a Resource Public Key Infrastructure (RPKI) relying-party validator, contains an origin-validation error in its RRDP processing. A delegated CA under the same Trust Anchor Locator (TAL) can reference a victim CA’s public RRDP notification and snapshot URLs. This causes the URL-based download cache to report success after deleting the victim’s local snapshot. Consequently, routine victim publications may silently remove Validated ROE (VRPs) and other signed objects from the output, which could lead to route hijacking or loss of reachability.

Recommendations Update to version 1.6.8. As a temporary workaround, disable HTTP/RRDP by setting the --http.enabled=false variable while keeping rsync enabled.