CVE-2026-55708

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.6 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En NLnet Labs Unbound 1.6.0 hasta la versión 1.25.1 inclusive, los comandos ’view_local_data’ y ’view_local_datas’ de ’unbound-control’ crean un árbol de zonas locales básico para una vista con nombre ya configurada cuando la vista se configura sin datos locales inicialmente. Sin embargo, la creación a través de la interfaz de control omite añadir las zonas protegidas por defecto (p. ej., inversas RFC 1918, zonas AS112, .onion, .localhost). Una vez que el árbol de zonas locales existe sin los valores por defecto, cada consulta para un nombre protegido por defecto de un cliente mapeado a esa vista escapa al DNS público a través del iterador en lugar de ser respondida localmente, eludiendo las expectativas de la política local.

Information

Published : 2026-07-22 14:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-55708

Mitre link : CVE-2026-55708

CVE.ORG link : CVE-2026-55708

JSON object : View

Products Affected

nlnetlabs

unbound

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-55708", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55708", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:09:14.145226Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.6}]}, "affected": [{"source": "sep@nlnetlabs.nl", "affectedData": [{"vendor": "NLnet Labs", "product": "Unbound", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.25.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T14:17:21.403", "references": [{"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-55708.txt", "tags": ["Vendor Advisory"], "source": "sep@nlnetlabs.nl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sep@nlnetlabs.nl", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations."}, {"lang": "es", "value": "En NLnet Labs Unbound 1.6.0 hasta la versi\u00f3n 1.25.1 inclusive, los comandos \u2019view_local_data\u2019 y \u2019view_local_datas\u2019 de \u2019unbound-control\u2019 crean un \u00e1rbol de zonas locales b\u00e1sico para una vista con nombre ya configurada cuando la vista se configura sin datos locales inicialmente. Sin embargo, la creaci\u00f3n a trav\u00e9s de la interfaz de control omite a\u00f1adir las zonas protegidas por defecto (p. ej., inversas RFC 1918, zonas AS112, .onion, .localhost). Una vez que el \u00e1rbol de zonas locales existe sin los valores por defecto, cada consulta para un nombre protegido por defecto de un cliente mapeado a esa vista escapa al DNS p\u00fablico a trav\u00e9s del iterador en lugar de ser respondida localmente, eludiendo las expectativas de la pol\u00edtica local."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlnetlabs:unbound:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08138649-8C21-4AD6-ADC3-45CD66607B71", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "sep@nlnetlabs.nl"}