Routinator CVE-2026-49234

Exploitation requires HTTP reach to Routinator's /api/v1/origins endpoint and the ability to send a non-UTF-8 byte sequence as the select-asn query parameter - trivially achievable with curl --data-urlencode or a raw socket. The vendor explicitly states the issue 'only affects users who allow API access from untrusted networks,' so the limiting factor is deployment posture: instances bound to 127.0.0.1 or fronted by an ACL that restricts the API to operator workstations are not exposed. No authentication is required (PR:N), no user interaction is needed (UI:N), and no special Routinator configuration beyond exposing the API is necessary. Note the CVSS vector lists AV:L which conflicts with the network-reachable API description and should be verified with the vendor before relying on it for prioritization.

Signals are mixed. The CVSS 4.0 vector specifies AV:L (local attack vector) with PR:N/UI:N, yet the description and the endpoint nature (HTTP API) indicate the vector is genuinely network-reachable whenever the API is bound to an interface accessible by untrusted users - the AV:L scoring likely reflects NLnet Labs' assumption that the API is normally restricted to localhost/management networks. This mismatch should be verified with the vendor; defenders exposing the API beyond loopback should treat the issue as network-reachable. There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, but the trigger is trivial (a single malformed query string) so a working PoC would be easy to construct. Real-world risk is concentrated at operators who deliberately or accidentally expose /api/v1/origins to untrusted networks; default-deployed instances bound to localhost are not exploitable remotely.

An attacker who can reach a Routinator instance whose HTTP API is exposed to an untrusted network issues a single HTTP GET to /api/v1/origins with a select-asn query parameter containing a non-UTF-8 byte sequence (for example, a lone 0x80 continuation byte). The Routinator process panics and exits, taking RPKI validation offline; any BGP routers consuming this validator via RTR fall back to NotFound state, weakening route-origin validation across the operator's network until the daemon is restarted.