Skip to main content

Unbound CVE-2026-55708

| EUVDEUVD-2026-47679 LOW
Initialization of a Resource with an Insecure Default (CWE-1188)
2026-07-22 NLnet Labs GHSA-c386-7qg7-h3qx
Authentication Bypass Unbound
3.1
CVSS 3.1 · Vendor: NLnet Labs

Severity by source

Vendor (NLnet Labs) PRIMARY
3.1 LOW
AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
vuln.today AI
3.1 LOW

Local-only trigger via unbound-control (AV:L), administrative privilege required (PR:H), administrator must actively issue the command (UI:R), limited confidentiality and integrity impact from DNS leakage (C:L/I:L), no availability impact.

3.1 AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
4.0 AV:L/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (NLnet Labs).

CVSS VectorVendor: NLnet Labs

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Patch available
Jul 22, 2026 - 16:18 EUVD
Analysis Generated
Jul 22, 2026 - 13:55 vuln.today

DescriptionCVE.org

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

AnalysisAI

Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain high-privilege access to Unbound management interface
Delivery
Identify named view with empty local-data configuration
Exploit
Issue view_local_data or view_local_datas against target view
Install
Unbound creates bare local zones tree without RFC 1918/AS112/.onion defaults
C2
Affected clients query protected names
Execute
Iterator forwards queries to public DNS resolvers
Impact
Private network metadata leaks externally
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) The target Unbound instance must be configured to use named views - the default non-view configuration is not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is low in absolute terms but policy-significant for environments relying on DNS views for privacy or network segregation enforcement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An administrator with unbound-control access issues a view_local_data command to add a local record to a named view that was defined in unbound.conf with no local-data entries. Unbound creates the bare local zones tree for that view in memory, omitting the RFC 1918 and AS112 defaults. …
Remediation Patch available per vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708.txt - an exact patched release version is not independently confirmed from the data available at time of analysis; operators should consult the advisory for the definitive fix version and upgrade accordingly. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Unbound

View all
CVE-2019-18934 HIGH POC
7.3 Nov 19

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv
CVE-2026-33278 CRITICAL
9.1 May 20

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attac
CVE-2026-42959 HIGH
8.7 May 20

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an at
CVE-2026-42944 HIGH
8.7 May 20

Heap overflow denial-of-service in NLnet Labs Unbound recursive DNS resolver versions 1.14.0 through 1.25.0 allows remot
CVE-2026-32665 HIGH
7.5 Jul 22

Remote denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 lets an unauthenticated client exhaust configured m
CVE-2026-55973 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.23.0 through 1.25.1 lets an attacker who controls a delegated DNS zone

CVE-2026-40691 HIGH
7.5 Jul 22

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recu
CVE-2026-44690 HIGH
7.5 Jul 22

DNS cache poisoning in NLnet Labs Unbound (1.7.0 through 1.25.1) lets an actor who controls a single delegated zone unde
CVE-2022-3204 HIGH
7.5 Sep 26

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv
CVE-2020-10772 HIGH
7.5 Nov 27

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020
CVE-2020-12663 HIGH
7.5 May 19

Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. Rated high severity
CVE-2020-12662 HIGH
7.5 May 19

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. Rated high severity

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2026-66066 CRITICAL POC
9.5
CVE-2025-70998 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-55708 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy