CVE-2026-55708
Received Received - Intake

Remote Local Zone Bypass in Unbound DNS

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: NLnet Labs

Description
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-55708
EUVD
EUVD-2026-47679

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nlnet_labs unbound 1.6.0
nlnet_labs unbound 1.25.1
nlnet_labs unbound From 1.6.0 (inc) to 1.25.1 (inc)
nlnet_labs unbound 1.25.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in NLnet Labs Unbound affects versions 1.6.0 to 1.25.1. It involves the 'view_local_data' and 'view_local_datas' commands in 'unbound-control' creating a local zones tree without including default-protected zones like RFC 1918 reverse zones, AS112 zones, .onion, and .localhost. Queries for these zones then bypass local policy by resolving through public DNS instead.

Detection Guidance

To detect this vulnerability, check if Unbound is running versions 1.6.0 to 1.25.1. Use the command 'unbound-control -V' to verify the version. If the version is within the affected range, the system may be vulnerable. Additionally, review unbound-control commands for 'view_local_data' or 'view_local_datas' usage in logs or configurations.

Impact Analysis

This vulnerability allows queries for default-protected zones to leak to public DNS, bypassing local policy. This could expose internal network queries or sensitive domain lookups to external DNS servers, potentially leaking information or violating intended access controls.

Compliance Impact

This vulnerability could lead to unauthorized exposure of internal DNS queries, potentially violating data protection requirements under GDPR or HIPAA by allowing sensitive domain lookups to be resolved externally instead of locally as intended.

Mitigation Strategies

Immediately upgrade Unbound to version 1.25.2 or later. If upgrading is not possible, apply the provided patch to version 1.25.1 and reinstall Unbound. The patch can be applied using the 'patch' command followed by recompiling and reinstalling the software.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55708. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart