medium · CVSS v3 6.5 · EPSS 0.00194

CVE-2026-50106

CVE-2026-50106 affects NLnet Labs Unbound DNS resolver up to version 1.26.1. The flaw allows an attacker to manipulate validation by forging

Overview

CVE-2026-50106 affects NLnet Labs Unbound DNS resolver up to version 1.26.1. The flaw allows an attacker to manipulate validation by forging NXDOMAIN responses, causing legitimate records in a trust island to be treated as insecure and denied. This undermines DNSSEC validation integrity.

Description

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.

Impact

Confidentiality: compromised DNSSEC validation may allow denial of service for clients relying on Unbound. Integrity: attacker can cause legitimate records to be considered insecure. Availability: denial of existence for records in the trust island. Defenders: DNS operators using Unbound 1.26.1 or earlier.

Remediation

Upgrade to Unbound 1.26.2 or later where the validation logic has been fixed. If upgrade is not possible, disable island-of-security zones or remove custom trust-anchor configurations. Ensure the root trust anchor is correctly configured and avoid mixing root and custom trust anchors.

Risk context

The CVE has a medium severity score (CVSS 6.5) and a very low EPSS of 0.00194, indicating a low probability of exploitation in the wild, but defenders should still address it promptly to maintain DNSSEC integrity.

Affected products

  • NLnet Labs Unbound 1.26.1

Scores

Severity
medium
CVSS v2
6.1
CVSS v3
6.5
CVSS v4
—
EPSS
0.00194

dns dnssec unbound validation medium root-trust-anchor island-of-security

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-111955

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.

View analysis

medium

CVE-2026-111956

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.

View analysis

medium

CVE-2026-111957

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.

View analysis