Improper Certificate Validation in Routinator - CVE-2026-72755
Published: October 27, 2026
Vulnerability identifier: #VU157709
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72755
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to replace a known good cached trust anchor certificate with an invalid certificate, potentially disrupting subsequent validation.
The vulnerability exists due to improper certificate validation before caching in Routinator's trust anchor certificate retrieval process when retrieving certificates over HTTPS. A remote attacker can supply an invalid trust anchor certificate, if able to influence the retrieved certificate, to overwrite a known good cached certificate even if validation fails.
Affected software
Routinator
How to mitigate CVE-2026-72755
Install security update from vendor's website.
Routinator - update to 0.15.3