NLnet Labs Unbound up to 1.25.1 Auth/Rpz Zone improper authentication

Summaryinfo

A vulnerability was found in NLnet Labs Unbound up to 1.25.1. It has been classified as very critical. This issue affects some unknown processing of the component Auth/Rpz Zone. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2026-50248. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in NLnet Labs Unbound up to 1.25.1. This issue affects an unknown code block of the component Auth/Rpz Zone. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no valid RRSIG required) becomes the zone's XFR primary and can replaces the entire zone/the resolver's entire response policy.

It is possible to read the advisory at nlnetlabs.nl. The identification of this vulnerability is CVE-2026-50248 since 06/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/23/2026).

Upgrading to version 1.25.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2492). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source Unbound

Productinfo

Vendor

• NLnet Labs

Name

• Unbound

Version

• 1.25.0
• 1.25.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion