Executive brief
FORT Validator is a critical infrastructure tool used by Internet service providers and network operators to validate routing data for the Border Gateway Protocol (BGP). A vulnerability allows an attacker to cause the validator to silently drop legitimate routing information from targeted CA operators, potentially enabling route hijacking or loss of network reachability—without requiring access to the victim's private keys or systems.
Technical details
The vulnerability is a cache poisoning attack arising from three composable weaknesses in FORT Validator's RRDP (Repository Delta Protocol) implementation: (1) the certificate validator accepts cross-repository SIA (Subject Information Access) pointers without validation, (2) the download cache memoizes by URL only without re-verification of cached artifacts, and (3) the RRDP session handler unconditionally deletes local workspace on serial change and trusts the notification URL. An attacker can craft a child CA certificate pointing to a victim's public RRDP notification URL, then publish a snapshot reference with the victim's URI and hash. On the victim's next routine publication (bumping serial), FORT deletes the victim's workspace and attempts to rebuild from the cached snapshot—which the cache reports as "recently downloaded" without re-fetching or parsing, leaving the workspace empty. This affects versions through 1.6.8. Versions 1.6.8+ patch by rejecting cross-origin RRDP URLs; as a workaround, administrators can disable HTTP/RRDP with --http.enabled=false.
Affected products
- NICMx FORT Validator through 1.6.7
Timeline
- 2026-05-31: disclosed
- 2026-05-31: patched: Version 1.6.8