The CVE number for this vulnerability is CVE-2026-72755.

== Summary
Routinator stores TA certificate in cache without validation

== Affected products
Routinator up to and including 0.15.2.

== Description
Routinator stores a newly-retrieved TA certificate via HTTPS in cache
without validation, potentially overwriting a known good TA certificate
even if validation fails.

== Solution
Install Routinator 0.15.3 or later.

== Acknowledgments
We would like to thank Xin Wang and Jiajia Liu, Northwestern Polytechnical
University for finding the vulnerability.