Unbound CVE-2026-55708

Exploitation requires three concurrent conditions: (1) The target Unbound instance must be configured to use named views - the default non-view configuration is not affected. (2) At least one named view in unbound.conf must have an empty local data section, meaning the view block contains no local-zone or local-data directives. (3) A user with administrative access to unbound-control must issue a view_local_data or view_local_datas command targeting that empty view. The attack vector is local (AV:L) and requires high privileges (PR:H), meaning only a user authorized to run unbound-control commands - typically root or a privileged service account - can trigger the condition. User interaction (UI:R) is required in that the administrator must actively issue the command. Non-views deployments, views with pre-existing local data, and environments where unbound-control access is restricted or unused are not affected.

Real-world risk is low in absolute terms but policy-significant for environments relying on DNS views for privacy or network segregation enforcement. The CVSS base score of 3.1 (Low) is consistent with AV:L/PR:H - exploitation requires an authorized administrator with local system access and permission to invoke unbound-control commands, substantially constraining the threat actor population. EPSS data was not provided, but the combination of low CVSS, local-only attack vector, and high privilege requirement strongly implies a low exploitation probability score. The vulnerability is not listed in CISA KEV and no publicly available exploit code has been identified. The primary real-world harm is information leakage: private IP reverse lookups, .onion name queries, and other protected-name queries from affected clients will be forwarded to public recursive infrastructure, potentially exposing internal network topology and violating confidentiality assumptions or regulatory requirements. Integrity is also marginally impacted because public DNS may return unexpected authoritative answers for AS112 and RFC 1918 reverse zones. The UI:R metric is notable - the misconfiguration cannot trigger spontaneously; an administrator must actively invoke the view_local_data command. This is a real priority for operators who enforce DNS policy through Unbound views, but the attack surface is narrow and the risk of widespread automated exploitation is negligible.

An administrator with unbound-control access issues a view_local_data command to add a local record to a named view that was defined in unbound.conf with no local-data entries. Unbound creates the bare local zones tree for that view in memory, omitting the RFC 1918 and AS112 defaults. From that point forward, clients mapped to that view - for example, internal hosts in a split-horizon deployment - receive answers from the public internet when querying 10.x.x.x reverse names or .onion addresses, leaking internal addressing data to upstream public resolvers. No exploit code is required; the trigger is the normal, intended use of the unbound-control command.