{"id":"CVE-2026-72755","kind":"vulnerability","aliases":["CVE-2026-72755"],"related":[],"title":"Routinator: unvalidated TA certificate fetched over HTTPS can overwrite cached trust anchor","description":"Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.","summary":"Routinator, an RPKI validator, caches a trust anchor certificate it fetches over HTTPS without validating it first. A failed validation can still replace a previously good cached certificate.","severity":"low","cvss":3.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","routinator","rpki","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T18:18:41+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:34:18+00:00","updated_at":"2026-10-26T18:34:18+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T18:34:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Routinator: unvalidated TA certificate fetched over HTTPS can overwrite cached trust anchor","impact":"medium","summary":"Routinator, an RPKI validator, caches a trust anchor certificate it fetches over HTTPS without validating it first. A failed validation can still replace a previously good cached certificate.","category":"package","nicknames":[],"who_cares":["routinator","rpki","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"A known good trust anchor cache entry gets overwritten with an unvalidated certificate.","analyst_note":"Find the affected Routinator versions and fixed release in the NVD entry or the upstream advisory, and confirm whether the TA fetch path is exposed to network attackers.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000507,"input_tokens":3274,"output_tokens":360,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-72755':15A,18A 'anchor':12A,32B 'cach':10A,29B,51B,64C 'certif':4A,33B,52B,60C,73C 'cve':13A,16A 'even':74C 'fail':43B,77C 'fetch':5A,35B 'first':41B 'good':50B,71C 'host':24B 'https':7A,37B,62C 'known':70C 'newli':57C 'newly-retriev':56C 'overwrit':9A,68C 'packag':19B 'potenti':67C 'previous':49B 'replac':47B 'retriev':58C 'routin':1A,20B,25B,53C 'rpki':21B,27B 'self':23B 'self-host':22B 'still':46B 'store':54C 'ta':3A,59C,72C 'trust':11A,31B 'unvalid':2A 'valid':28B,39B,44B,66C,76C 'via':61C 'without':38B,65C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-72755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72755","severity":null,"published_at":"2026-10-26T18:18:41+00:00","modified_at":"2026-10-26T18:18:41+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}