CVE-2026-49233: Routinator Path Traversal Vulnerability

CVE-2026-49233 Overview

CVE-2026-49233 is a path traversal vulnerability [CWE-22] in NLnet Labs Routinator, a Resource Public Key Infrastructure (RPKI) Relying Party software used to validate Border Gateway Protocol (BGP) route origins. Routinator fails to properly validate the module component of rsync Uniform Resource Identifiers (URIs) before using them to construct filesystem paths for its local cache. An attacker who controls or influences an rsync URI can supply a module name containing .. sequences. This enables traversal outside the intended cache directory and grants access to the entire Routinator rsync cache.

Critical Impact
Network-reachable attackers can leverage crafted rsync module names to traverse the Routinator cache filesystem, compromising integrity and availability of cached RPKI data used for BGP route validation.

Affected Products

NLnet Labs Routinator (RPKI Relying Party software)
Deployments using rsync as a transport for RPKI repository synchronization
BGP route validation infrastructure relying on Routinator output

Discovery Timeline

2026-06-08 - CVE-2026-49233 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49233

Vulnerability Analysis

Routinator synchronizes RPKI repositories using rsync URIs of the form rsync://host/module/path. The software maps these URIs to local filesystem paths within its cache directory. The vulnerability stems from insufficient validation of the module component during this mapping. When a module name contains .. traversal sequences, the resulting filesystem path escapes the intended cache subdirectory.

An attacker who can serve or inject malicious RPKI repository references can supply a module name such as ../../other-publisher to redirect writes or reads to arbitrary locations within the Routinator rsync cache. This breaks the isolation between distinct repository publishers and undermines the integrity of cached Route Origin Authorizations (ROAs) and manifests.

The vulnerability is network-exploitable without authentication or user interaction. Successful exploitation does not yield code execution, but it does compromise the integrity and availability of cached RPKI data, which directly influences BGP route validation decisions.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Routinator concatenates the rsync URI module component into a filesystem path without canonicalizing the result or rejecting .. segments. The trust placed in the module string allows attacker-controlled traversal.

Attack Vector

Exploitation requires the attacker to influence the rsync URIs that Routinator processes, typically by operating or compromising an RPKI publication point referenced from a trust anchor or delegated certificate. The attacker then publishes objects that reference an rsync URI containing a crafted module name. When Routinator fetches and stores the data, the traversal redirects filesystem operations to arbitrary paths within the cache tree. Refer to the NLnet Labs CVE-2026-49233 Details for vendor-supplied technical specifics.

Detection Methods for CVE-2026-49233

Indicators of Compromise

Files or directories within the Routinator rsync cache whose paths contain unexpected parent directory traversal artifacts or unusual sibling-publisher contents
rsync fetch logs referencing module components containing .. or other non-standard path characters
Unexpected modifications to cache entries belonging to publishers that Routinator did not directly synchronize during a given run

Detection Strategies

Audit Routinator logs and rsync transfer records for URIs whose module segment contains .., encoded traversal sequences, or other anomalous characters
Compare the cache directory layout against the expected hierarchy of configured trust anchors and known publication points
Monitor filesystem integrity on the Routinator cache directory using checksum baselines and alert on writes outside expected publisher subdirectories

Monitoring Recommendations

Enable verbose logging in Routinator and forward logs to a central analytics platform for retention and correlation
Track RPKI validation output (VRPs) for sudden changes that could indicate cache tampering
Alert on process activity that performs filesystem writes outside the configured Routinator cache root

How to Mitigate CVE-2026-49233

Immediate Actions Required

Upgrade Routinator to a fixed release as specified in the NLnet Labs CVE-2026-49233 Details advisory
Purge and rebuild the existing rsync cache after upgrading to remove any traversal artifacts left by prior fetches
Review trust anchor configuration and remove unnecessary or untrusted publication points

Patch Information

NLnet Labs has published advisory details and fixed release information at the NLnet Labs CVE-2026-49233 Details page. Operators should consult the advisory for the specific fixed version and apply the upgrade across all Routinator instances feeding BGP routers.

Workarounds

Disable rsync as a transport and rely on the RPKI Repository Delta Protocol (RRDP) where supported by upstream publishers
Run Routinator under a dedicated unprivileged user with strict filesystem permissions confining writes to the cache directory
Apply mandatory access control profiles (AppArmor or SELinux) that restrict the Routinator process to its intended cache path

bash

# Configuration example: restrict rsync usage in routinator.conf
disable-rsync = true
rrdp-timeout = 300
# Run Routinator under a dedicated unprivileged user
# useradd --system --home /var/lib/routinator --shell /usr/sbin/nologin routinator
# chown -R routinator:routinator /var/lib/routinator