Live › vulnerability › CVE-2026-50106
Go to dashboardUnbound up to and including 1.26.1 can be configured with a root trust anchor plus an extra trust-anchor for a DNSSEC island whose parent is insecure. A forged NXDOMAIN with a crafted RRSIG SignerName can make the validator treat records inside that island as insecure, so an attacker can deny their existence.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only resolvers that have both the root trust anchor and an additional trust-anchor for a DNSSEC island under an insecure parent are exposed. An attacker must be able to deliver a forged response to the resolver, so resolvers reachable by untrusted network paths are the most at risk. Resolvers with only the default root trust anchor are not described as affected.
No product ranges from the sources yet.
unbound -V to read the installed version and confirm it is 1.26.1 or oldertrust-anchor: entry, especially one for a zone whose parent is insecure, using grep -r trust-anchor /etc/unbound1.26.1; the sources do not name the fixed versiontrust-anchor: if it is not neededEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.
This page as .md · .json · in your agent: get_signal("CVE-2026-50106")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.