CVE-2026-50106

Awaiting Analysis Awaiting Analysis - Queue

Unbound DNS Validator Cache Poisoning via NXDOMAIN Response

Publication date: 2026-10-21

Last updated on: 2026-10-29

Assigner: NLnet Labs

Description

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-50106

EUVD

EUVD-2026-107152

Affected Vendors & Products

Vendor	Product	Version / Range
NLnet Labs	Unbound	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

Executive Summary

CVE-2026-50106 is a vulnerability in Unbound DNS software versions up to 1.26.1. It occurs when Unbound is configured with a root trust anchor and an additional trust anchor for an island-of-security zone whose parent is provably insecure. An attacker can forge an NXDOMAIN response for a name in the island, setting the NSEC/SOA RRSIG SignerName to the insecure parent. This tricks Unbound into using the root trust anchor and then the insecure parent, causing records in the trust island to be treated as insecure and denying their existence.

Detection Guidance

To detect this vulnerability, check the Unbound version running on your system using 'unbound -V'. If the version is 1.26.1 or earlier, the system is potentially vulnerable. Additionally, review Unbound configuration files for trust anchors and island-of-security zones with insecure parents.

Impact Analysis

An attacker could exploit this to deny the existence of legitimate DNS records in the trust island, leading to service disruptions or misdirection. This could prevent users from accessing critical services or websites, causing downtime or security risks if malicious domains are resolved instead.

Compliance Impact

This vulnerability could impact compliance with standards requiring secure DNS resolution, such as GDPR's data integrity requirements or HIPAA's secure data transmission rules, by enabling denial-of-existence attacks that falsely indicate records do not exist. This may lead to unauthorized data access or service disruptions, undermining trust in DNS-based security measures.

Mitigation Strategies

Immediately upgrade Unbound to version 1.26.2 or later. If upgrading is not possible, apply the manual patch provided by NLnet Labs. Ensure configurations do not include trust anchors for island-of-security zones with insecure parents.

Hi! I’m here to help you understand CVE-2026-50106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...