The vulnerability in FORT Validator (up to version 1.6.7) involves an origin validation error (CWE-346) in the RRDP processing component. A delegated CA sharing the same Trust Anchor Locator can maliciously reference a victim CA’s public RRDP notification and snapshot URLs. This causes FORT Validator's URL-based download cache to report success after deleting the victim’s local snapshot, leading to silent removal of the victim’s validated route-origin data (VRPs and signed objects) from the validator’s output. This can result in route hijacking or loss of network reachability. The issue is addressed in version 1.6.8 by rejecting cross-origin RRDP snapshot and delta URLs. Alternatively, disabling HTTP/RRDP with the --http.enabled=false option while using rsync can mitigate the issue, though with potential data availability trade-offs.

Successful exploitation can cause the victim’s validated route-origin data to be silently removed from FORT Validator’s output, potentially enabling route hijacking or loss of reachability. This impacts the integrity and availability of validated routing information, which is critical for network security and routing correctness.

Version 1.6.8 of FORT Validator contains an official patch that rejects cross-origin RRDP snapshot and delta URLs, resolving the vulnerability. Administrators should upgrade to version 1.6.8 or later. As a temporary workaround, HTTP/RRDP can be disabled using the --http.enabled=false option while keeping rsync enabled; however, this may lead to data unavailability or staleness where rsync is unsupported. Patch status is not explicitly confirmed beyond the mention of version 1.6.8 containing the fix; verify with the vendor advisory for the latest remediation guidance.