Which versions of Routinator are affected by CVE-2026-49233?

NLnet Labs Routinator contains a path traversal vulnerability (CVSS 8.3) that allows unauthenticated remote attackers to bypass rsync cache boundaries and modify routing information.. A patch is available.

How to fix or mitigate CVE-2026-49233?

24 hours: Inventory all Routinator deployments and restrict network access to rsync operations; escalate to your NLnet Labs technical contact for vendor guidance. 7 days: Deploy firewall rules limiting incoming rsync connections to trusted sources only and enable detailed logging of rsync module access. 30 days: Monitor vendor advisories for patch availability; prepare testing procedures for Routinator security updates when released.

Routinator CVE-2026-49233

Q: What is the CVSS score of CVE-2026-49233?

CVE-2026-49233 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35063 HIGH

Path Traversal (CWE-22)

2026-06-08 NLnet Labs

GHSA-33mj-99mg-8g73

Path Traversal Routinator

8.3

CVSS 4.0 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NLnet Labs) · only source for this CVE.

CVSS VectorVendor: NLnet Labs

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:51 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

8.3 (HIGH)

CVE Published

Jun 08, 2026 - 12:58 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

AnalysisAI

Path traversal in NLnet Labs Routinator allows remote attackers to escape the rsync cache directory by supplying rsync URIs whose module component contains '..' sequences, enabling read/write access across the entire Routinator rsync cache filesystem. The flaw is network-reachable and requires no authentication, and no public exploit identified at time of analysis. CVSS 4.0 of 8.3 reflects high integrity and availability impact with an attack requirement (AT:P) reducing it from critical.

Technical ContextAI

Routinator is NLnet Labs' Relying Party software for RPKI (Resource Public Key Infrastructure), used by network operators to validate BGP route origins against signed cryptographic data published by RIRs and resource holders. To collect this data, Routinator fetches repositories over rsync and RRDP, mapping remote rsync URIs (rsync://host/module/path) into a local cache directory tree. The vulnerability is a classic CWE-22 Path Traversal: the module component of a remote rsync URI is concatenated into the local cache filesystem path without sanitizing '..' sequences, so a malicious or compromised upstream repository can direct writes/reads outside its intended subdirectory. Affected component identified by CPE cpe:2.3:a:nlnet_labs:routinator (all versions prior to the fix).

RemediationAI

Vendor-released patch: upgrade Routinator to 0.15.2 or later per the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt, which is the primary and recommended fix. If immediate patching is not possible, restrict the set of trust anchors and rsync publication points Routinator is configured to fetch from to those operated by trusted RIRs only (this reduces but does not eliminate exposure, since a compromised RIR-adjacent repo could still trigger the issue), and consider temporarily preferring RRDP over rsync where the deployment supports it to narrow the attack surface against the rsync code path. Monitor the Routinator cache directory for unexpected files or paths outside expected module subdirectories as a detective control, accepting that this is reactive rather than preventive.