Unexpected server downtime via unbound server name in Director advertisements

Impact

On July 23, 2026, an open-source community member reported a security vulnerability in the Pelican Director (the federation service that routes clients to origins and caches) to the Pelican team. We have confirmed that any authenticated, already-registered origin or cache can cause unexpected downtime behavior for a different server of its choosing: the Director may stop sending clients to a healthy server, or send clients back to a server whose operator had deliberately scheduled downtime.

When a server advertises itself to the Director, the Director decides which server an advertisement's downtime and shutdown status apply to using a free-form name field in the advertisement. That name is never checked against the registry identity that the server's advertise token actually authorizes. As a result, a server holding a valid advertise token for its own prefix can send an advertisement carrying a victim server's name and tamper with the victim's routing state in two ways:

• Suppress routing: advertise the victim's name with a "shutting down" status or an active downtime entry, and the Director stops routing clients to the healthy victim.
• Resume routing: advertise the victim's name with no status and an empty downtime list, and the Director clears the victim's own scheduled downtime, sending clients back to a server its operator had deliberately taken offline.

The effect is transient because the victim's next healthy advertisement clears the filter. However, because the Director enforces no rate limit on advertisements, an attacker can re-assert the condition continuously and keep the victim out of routing for as long as the attack runs. This flaw's only precondition is being a normal registered origin or cache, which every OSDF participant is, so OSDF is exposed in its normal configuration.

Immediate Action

There is no configuration setting that disables this behavior. Federation administrators should watch for healthy servers being unexpectedly dropped from Director routing (for example, a server reporting itself as up while the Director treats it as shutting down or in downtime). The offending origin or cache can be identified from the Director's advertisement logs and removed from the federation to stop the abuse.

If you do not operate a Pelican Director (for example, you run an origin or cache, or you only use the Pelican client to access data), no action is required on your part.

Patches

An upcoming patch will make the Director apply downtime and shutdown status using the token-verified registry identity of the advertising server rather than the free-form name field; an advertisement whose name does not match the server registered under its token's prefix can no longer change any server's downtime or routing state. Pelican Director administrators running an affected version should upgrade to the patched release once it is available. The OSDF Director is already running the patched code.