CVE-2026-49233: Routinator cache path traversal using rogue rsync URIs

Synopsis

A path traversal vulnerability in NLnet Labs Routinator allows an attacker to manipulate the module component of rsync URIs, causing Routinator to write or overwrite files outside the intended cache directory. The vulnerability is reachable over the network with no authentication required, as derived from the CVSS vector. Successful exploitation lets an attacker tamper with the Routinator rsync cache at arbitrary paths, and can also disrupt the availability of the cache service. A patched-image rebuild at version 0.15.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Routinator service over the network by serving a rogue rsync URI from a reachable rsync server.

• AuthenticationNot required

  No credentials or account are needed; the attack is triggered through the rsync URI handling logic without prior authentication.

• Victim interactionNot required

  No user interaction is required; Routinator processes the malicious URI automatically as part of its normal cache synchronization.

• Attack complexityDetail

  The base exploit path is reliable and condition-free, though the CVSS AT:P token notes that specific deployment conditions (such as a reachable rogue rsync endpoint) must be in place.

Blast Radius

• Attacker writes or overwrites files at arbitrary paths on the host filesystem, escaping the intended Routinator cache directory boundary.
• Attacker corrupts or replaces cached RPKI (Resource Public Key Infrastructure) data, poisoning the Route Origin Validation feed that downstream BGP routers may rely on.
• Attacker disrupts availability of the Routinator cache service, causing validation failures or service outages for dependent routing infrastructure.
• Attacker gains persistent influence over cache contents across repeated sync cycles until the path traversal is closed.