CVE-2026-53499: FORT Validator Privilege Escalation Flaw

CVE-2026-53499 Overview

CVE-2026-53499 is an origin-validation flaw [CWE-346] in FORT Validator, a Resource Public Key Infrastructure (RPKI) relying-party validator that produces validated route-origin data. Versions through 1.6.7 mishandle Repository Delta Protocol (RRDP) processing. A delegated Certificate Authority (CA) under the same Trust Anchor Locator (TAL) can reference a victim CA's public RRDP notification and snapshot URLs. This causes FORT's URL-based download cache to report success after deleting the victim's local snapshot, silently removing the victim's Validated ROA Payloads (VRPs) from FORT's output.

Critical Impact
A malicious delegated CA can strip a victim CA's signed RPKI objects from validator output, enabling BGP route hijacking or loss of reachability for the victim's prefixes.

Affected Products

FORT Validator versions through 1.6.7
Deployments using HTTP/RRDP as a repository fetch mechanism
RPKI relying-party infrastructure feeding BGP route filtering

Discovery Timeline

2026-08-21 - CVE-2026-53499 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-53499

Vulnerability Analysis

FORT Validator retrieves RPKI repository content over RRDP, caching downloads by URL. The validator fails to verify that a delegated CA is authorized to reference the RRDP notification and snapshot URLs it publishes. When a malicious CA under the same TAL declares another CA's public RRDP URLs in its own manifest, FORT processes the reference and marks the URL-based cache entry as successfully handled. As part of this processing, FORT deletes the victim's local snapshot from its cache.

After a routine publication by the victim CA, FORT's next validation run fails to reconstruct the victim's repository state. The victim's VRPs and other signed objects disappear from validator output. Downstream BGP routers consuming the RTR feed no longer see valid ROAs covering the victim's prefixes.

Root Cause

The root cause is missing origin validation on cross-CA RRDP references. FORT does not enforce that the RRDP notification and snapshot URLs listed by a delegated CA belong to that CA's own publication point. This is a classic origin-validation error tracked as [CWE-346].

Attack Vector

Exploitation requires an attacker to control a delegated CA that shares a TAL with the victim. The attacker publishes a manifest containing the victim's RRDP URLs. Validators fetch and process the crafted repository, then evict the victim's cached snapshot. The attack is network-reachable and requires low privileges relative to the RPKI trust hierarchy. The consequence is loss of route-origin authorization data, which BGP operators depend on to reject hijacked announcements.

Detection Methods for CVE-2026-53499

Indicators of Compromise

Sudden disappearance of expected VRPs from FORT Validator output for prefixes previously covered by valid ROAs
FORT cache directory showing recent deletion of snapshot files belonging to unrelated publication points
RRDP notification.xml references in one CA's manifest that point to another CA's publication host
Divergence between FORT VRP output and output from other RPKI validators such as Routinator or rpki-client

Detection Strategies

Compare VRP output across multiple relying-party validators and alert on prefixes present in peers but absent in FORT
Audit FORT logs for RRDP fetch entries where the referenced URL host does not match the referring CA's expected publication point
Monitor RTR feed churn for unexplained withdrawals of ROAs from established resource holders

Monitoring Recommendations

Instrument BGP route validation results to detect a rise in NotFound states for prefixes previously Valid
Log and retain all RRDP notification and snapshot fetch URLs for forensic correlation with cache deletion events
Track FORT Validator version across all deployed instances and alert on any running 1.6.7 or earlier

How to Mitigate CVE-2026-53499

Immediate Actions Required

Upgrade FORT Validator to version 1.6.8 or later, which rejects cross-origin RRDP snapshot and delta URLs
Inventory all FORT deployments feeding production RTR sessions and prioritize patching
Cross-check current VRP output against a second, independent RPKI validator before trusting BGP filtering decisions

Patch Information

FORT Validator 1.6.8 contains the fix. The patch enforces that RRDP snapshot and delta URLs originate from the same publication point as the referring CA. See the FORT Validator GitHub Security Advisory GHSA-qfm3-577x-rh54 for release details.

Workarounds

Disable HTTP/RRDP with --http.enabled=false while keeping rsync enabled as the sole fetch transport
Accept that rsync-only operation can leave repository data unavailable or stale where publication points do not support rsync
Deploy a second validator implementation in parallel and reconcile VRP output before publishing to RTR clients

bash

# Disable RRDP as a temporary workaround until upgrade to 1.6.8
fort --http.enabled=false --rsync.enabled=true