Which versions of NSD are affected by CVE-2026-12490?

NLnet Labs NSD's zone-transfer authentication control bypass allows unauthenticated attackers to extract complete DNS zone databases without required TLS client certificates, exposing organizational…. A patch is available.

How to fix or mitigate CVE-2026-12490?

Within 24 hours: Identify all systems running NLnet Labs NSD and audit secondary nameserver configurations. Within 7 days: Implement access controls-restrict zone-transfer requests to explicitly whitelisted IP addresses and disable zone transfers on non-TLS ports if operationally feasible. Within 30 days: Evaluate alternative DNS authoritative servers with stronger zone-transfer controls or plan NSD upgrade once patches become available; monitor NLnet Labs security advisories for vendor patch release.

NSD CVE-2026-12490

Q: What is the CVSS score of CVE-2026-12490?

CVE-2026-12490 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-39185 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-25 NLnet Labs

GHSA-27xx-c7vg-hjjj

Authentication Bypass Nsd Red Hat Suse

8.2

CVSS 4.0 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable with no auth (the missing client-cert check is the flaw, PR:N); AC:H because it depends on a tls-auth-name config and matching provide-xfr conditions; impact is zone disclosure only (C:H, I:N, A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 MEDIUM

qualitative

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 08:01 EUVD

Analysis Generated

Jun 25, 2026 - 07:01 vuln.today

DescriptionCVE.org

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

AnalysisAI

Zone-transfer authentication bypass in NLnet Labs NSD allows unauthorized secondaries to obtain full zone contents without presenting the required TLS client certificate. Although a provide-xfr rule specifies a tls-auth-name (mandating client-certificate authentication), NSD only enforces this on the dedicated tls-auth-port; requests arriving over plain TCP on the regular port or over TLS on the regular tls-port are served when the remaining provide-xfr conditions match, defeating mutual-TLS access control. Reported by NLnet Labs with CVSS 4.0 8.2; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

NSD (Name Server Daemon) is an authoritative-only DNS server. Zone transfers (AXFR/IXFR) replicate zone data from a primary to secondaries and are gated by provide-xfr ACL rules. NSD supports XFR-over-TLS (RFC 9103) with mutual authentication: binding a tls-auth-name to a provide-xfr rule is intended to require the requesting secondary to present a matching X.509 client certificate, served on a dedicated tls-auth-port. The flaw is an instance of CWE-306 (Missing Authentication for Critical Function): the client-certificate check is tied to the tls-auth-port listener rather than to the provide-xfr rule itself, so the same rule's address/key conditions can be satisfied over the regular tls-port (no client cert) or plain TCP, skipping the certificate verification entirely. The affected product per CPE is cpe:2.3:a:nlnet_labs:nsd (all versions enumerated).

RemediationAI

Upgrade NSD to the patched release referenced in the NLnet Labs advisory at https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt (patch available per vendor advisory; the exact fixed version is not included in the provided data and must be taken from that advisory). As compensating controls until patched: restrict the regular tls-port and TCP DNS port so that only the dedicated tls-auth-port is reachable from secondaries that should use client-certificate auth (e.g., firewall the standard 53/TCP and non-auth TLS listener from transfer peers), accepting that legitimate non-cert transfers on those ports will also be blocked; tighten provide-xfr rules with strict source-address ACLs and TSIG keys so a bypassing request cannot satisfy the remaining match conditions, accepting the operational overhead of TSIG key management; and monitor query/transfer logs for AXFR/IXFR served over non-auth ports. Do not rely on tls-auth-name alone for confidentiality until the upgrade is applied.