NLnet Labs Routinator EUVD-2026-110028

Requires that Routinator be configured to retrieve a trust anchor certificate over HTTPS (a TAL referencing an https:// TA URI) and that the attacker can cause an invalid or altered certificate to be returned at that retrieval - i.e., control of or tampering with the TA source over the TLS channel. The defect is that Routinator writes the newly-retrieved TA certificate to cache even when its validation fails, overwriting the existing known-good TA. Limiting factors: the privileged network/source position implied by PR:H, dependence on HTTPS-based TA retrieval rather than other transport, no user interaction, and impact bounded to degraded RPKI validation (I:L/A:L) with no data exposure. The exact attacker position is not detailed in the available sources.

All decision signals point to low real-world priority. The source CVSS is only 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L): network vector but requiring high privileges (PR:H) and yielding only low integrity and low availability impact with no confidentiality loss (C:N). The vuln.today decision label is 'monitor', the weakest urgency tier. No EPSS probability, no CISA KEV listing, and no public exploit or PoC reference are present in the input, so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent - a low CVSS paired with a 'monitor' label and no exploitation evidence - with one metadata conflict: the 'Information Disclosure' tag contradicts the vector's C:N (no confidentiality impact), so that tag appears mislabeled and should not drive risk perception. This is a robustness/error-handling defect (CWE-755) in a specialized RPKI validator, not a priority for emergency patching; schedule remediation via normal update cycles.

An attacker able to influence the HTTPS endpoint from which Routinator retrieves a trust anchor (TA) certificate - for example by controlling or tampering with that source - serves an invalid or modified TA certificate. Routinator stores the retrieved certificate in its cache even though validation fails, overwriting the previously known-good TA and thereby disrupting trusted RPKI route-origin validation. No public exploit or PoC reference is identified in the available data.