NLnet Labs Unbound CVE-2026-50106

Requires Unbound ≤1.26.1 configured with BOTH a root trust anchor AND an additional explicit 'trust-anchor:' statement for an island-of-security zone whose parent is provably insecure under the root chain - a specialized, non-default configuration that most resolvers do not run. The attacker must be able to deliver at least one forged NXDOMAIN response for a name inside that island (requiring on-path position or the ability to spoof/race a response) with the NSEC/SOA RRSIG SignerName set to the insecure parent. Limiting factors: no authentication and no user interaction are needed (PR:N/UI:N), but the uncommon island-of-security configuration and the need to craft and successfully deliver the specific forged response (reflected in AC:H) substantially constrain realistic exploitation.

This is a medium-severity DNSSEC validation flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) in NLnet Labs Unbound ≤1.26.1, classified as CWE-807 (reliance on untrusted inputs in a security decision). The signals are internally consistent and point to a real-but-bounded risk rather than a drop-everything emergency. On one hand, the vector is network-reachable and requires no privileges or user interaction (AV:N/PR:N/UI:N), and the impact on availability is high (A:H) because the flaw lets an attacker suppress the existence of validly-signed records inside a configured trust island. On the other hand, AC:H and the vendor description show that successful exploitation depends on a specialized, non-default configuration (an explicit island-of-security 'trust-anchor:' whose parent is provably insecure) plus the ability to deliver a forged NXDOMAIN with a manipulated RRSIG SignerName. No EPSS score, no CISA KEV listing, and no POC indicator are present in the input, so there is no evidence of active or widespread exploitation - no public exploit identified at time of analysis. Net assessment: a legitimate integrity/availability bug for the subset of Unbound deployments using island-of-security trust anchors, but the narrow configuration prerequisite and high attack complexity substantially limit real-world exposure. Note a data conflict: the 'Information Disclosure' tag contradicts the CVSS confidentiality metric (C:N) and the described denial-of-existence impact - treat the tag as suspect.

An attacker positioned to inject or spoof DNS responses (on-path, or exploiting a response-spoofing window) sends a forged NXDOMAIN for a name within a victim's configured island-of-security zone, setting the NSEC/SOA RRSIG SignerName to the island's provably-insecure parent. Unbound's validator is tricked into falling back to the root trust anchor and the insecure parent chain, so it treats the response as insecure and denies existence of records that are actually validly signed under the island trust anchor. No public exploit identified at time of analysis; exploitation requires high complexity (AC:H) and a non-default trust-anchor configuration.