Routinator, an open-source BGP Route Origin Authorization validator, caches Trust Anchor (TA) certificates retrieved via HTTPS without validating them. This flaw, classified as CWE-755, allows an attacker who can supply a malicious TA certificate to the software to overwrite an existing, valid certificate in the cache. The result is a potential loss of trust in routing data, as the cached TA would no longer be verified against a proven source. The vulnerability enables an integrity compromise of the certificate store, which could enable routing violations if the attacker’s certificate is accepted as authentic.

The issue affects the NLnet Labs Routinator product. All installations earlier than version 0.15.3 are impacted. Versions 0.15.3 and later include the fix and are not vulnerable.

The CVSS score of 3.8 indicates moderate severity, and the EPSS score is unavailable, suggesting limited or unknown exploitation prevalence. The vulnerability is not listed in the CISA KEV catalogue, indicating no confirmed widespread exploitation. The likely attack path requires an attacker with the ability to inject a forged TA certificate over HTTPS to the Routinator instance; the lack of validation means the certificate will be stored unconditionally. Because the flaw is about data caching rather than remote code execution or privileged escalation, the exploitation risk is primarily local or network-based if the attacker can reach the server and present a malicious certificate payload.