Unbound 1.6.0-1.25.1 unsafely omits default zones via unbound-control
CVE-2026-55708 Published on July 22, 2026
Privacy/configuration issue when adding local data in views through 'unbound-control'
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
Timeline
Issue reported by Qifan Zhang
NLnet Labs shares patch 30 days later.
Qifan Zhang verifies patch 3 days later.
Fixes released with version 1.25.2 41 days later.
Weakness Type
Insecure Default Initialization of Resource
The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
Products Associated with CVE-2026-55708
Want to know whenever a new CVE is published for Nlnetlabs Unbound? stack.watch will email you.
Affected Versions
NLnet Labs Unbound:- Version 1.6.0 and below 1.25.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.