CVE-2026-53499: CWE-346: Origin Validation Error in NICMx FORT-validator

CVE-2026-53499 is an origin validation error (CWE-346) in NICMx's FORT Validator, a Resource Public Key Infrastructure relying-party validator. The vulnerability exists in versions up to 1.6.7 and involves RRDP processing where a delegated CA under the same Trust Anchor Locator can reference a victim CA's public RRDP notification and snapshot URLs. This causes FORT Validator's URL-based download cache to report success after deleting the victim's local snapshot. Consequently, after a routine victim publication, the victim's validated route-origin payloads (VRPs) and other signed objects can be silently removed from FORT's output, potentially enabling route hijacking or loss of reachability. The issue is addressed in version 1.6.8 by rejecting cross-origin RRDP snapshot and delta URLs. A workaround is to disable HTTP/RRDP with the --http.enabled=false option while keeping rsync enabled, though this may lead to data being unavailable or stale in environments without rsync support.

The vulnerability allows an attacker controlling a delegated CA under the same Trust Anchor Locator to cause the victim CA's validated route-origin data and signed objects to be silently removed from FORT Validator's output. This can lead to route hijacking or loss of network reachability due to missing or incorrect route-origin validation information.

A patch is available in FORT Validator version 1.6.8 that rejects cross-origin RRDP snapshot and delta URLs, resolving the origin validation error. Administrators should upgrade to version 1.6.8 or later. As a temporary workaround, HTTP/RRDP can be disabled using the --http.enabled=false option while keeping rsync enabled; however, this may cause data unavailability or staleness where rsync is not supported.