NLnet Labs Unbound EUVD-2026-47674

Exploitation requires all of the following to be simultaneously true: (1) The target Unbound instance must be configured with an auth-zone or rpz block that specifies a primary server using a hostname rather than a literal IP address. (2) That hostname's A/AAAA resolution must result in a BOGUS DNSSEC status - either because the zone is insecure and unsigned or because an existing DNSSEC chain-of-trust failure is present. (3) The attacker must be able to control what IP address the resolver receives for that hostname, requiring either an on-path network position or successful upstream DNS cache poisoning - no valid RRSIG is required for the spoofed record. No authentication to the Unbound instance itself is needed (PR:N per CVSS). Deployments using static IP addresses for primary server configuration are not affected. Resolvers not using auth-zone or rpz functionality are not affected.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L accurately captures the attack profile. AC:H reflects the genuine difficulty of spoofing a DNS hostname - the attacker must control or intercept resolution for the primary hostname, typically requiring an on-path position or successful DNS cache poisoning of an upstream resolver. I:H is well-justified because a successful attack replaces the entire RPZ zone, negating an organization's entire DNS-layer threat blocking policy. A:L accounts for potential zone inconsistency disrupting resolution. EPSS data was not provided in the supplied intelligence; however, the non-trivial AC:H requirement and the specificity of the vulnerable configuration (RPZ with hostname-based primaries) suggest lower opportunistic exploitation probability than the 6.5 CVSS base score alone might imply. This is not in the CISA KEV, and no POC has been identified at time of analysis, further deprioritizing it for mass exploitation scenarios. That said, the integrity impact for organizations actively relying on RPZ for DNS firewall enforcement - blocking malware C2 or phishing domains - is severe: an attacker who successfully executes this attack can silently nullify all those controls.

An attacker targeting an organization that uses Unbound with RPZ-based DNS blocking positions themselves to intercept or poison resolution of the hostname configured as the RPZ primary (e.g., via BGP hijack, rogue resolver injection, or spoofing at the network level). They return a crafted A/AAAA record without a valid RRSIG, causing DNSSEC validation to mark it BOGUS - but Unbound still contacts the attacker-controlled IP for zone transfers. The attacker's rogue nameserver responds with a malicious RPZ zone that either removes all blocking rules or actively redirects victim queries to attacker-controlled infrastructure, silently bypassing the organization's DNS firewall.