{"id":"CVE-2026-50106","kind":"vulnerability","aliases":["CVE-2026-50106"],"related":[],"title":"Unbound DNS resolver: forged NXDOMAIN can deny records in trust islands","description":"When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.","summary":"Unbound up to and including 1.26.1 can be configured with a root trust anchor plus an extra trust-anchor for a DNSSEC island whose parent is insecure. A forged NXDOMAIN with a crafted RRSIG SignerName can make the validator treat records inside that island as insecure, so an attacker can deny their existence.","severity":"medium","cvss":6.5,"epss":0.00194,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","infrastructure","self-hosted","unbound"],"not_affected_if":["default-config","root-anchor-only"],"how_to_check":"- Run `unbound -V` to read the installed version and confirm it is `1.26.1` or older\n- Check the config for more than one `trust-anchor:` entry, especially one for a zone whose parent is insecure, using `grep -r trust-anchor /etc/unbound`","fix":"- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the fixed version\n- Remove the extra island `trust-anchor:` if it is not needed","status":"open","published_at":"2026-10-21T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:06+00:00","updated_at":"2026-10-25T03:49:06+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:49:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the fixed version\n- Remove the extra island `trust-anchor:` if it is not needed","reach":"network","title":"Unbound DNS resolver: forged NXDOMAIN can deny records in trust islands","impact":"medium","summary":"Unbound up to and including 1.26.1 can be configured with a root trust anchor plus an extra trust-anchor for a DNSSEC island whose parent is insecure. A forged NXDOMAIN with a crafted RRSIG SignerName can make the validator treat records inside that island as insecure, so an attacker can deny their existence.","category":"infrastructure","nicknames":[],"who_cares":["unbound","dns","dnssec","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker makes records in a trust island appear nonexistent to clients","analyst_note":"Confirm the fixed Unbound version and the vendor advisory text at https://nvd.nist.gov/vuln/detail/CVE-2026-50106 since the sources do not give a fix.","how_to_check":"- Run `unbound -V` to read the installed version and confirm it is `1.26.1` or older\n- Check the config for more than one `trust-anchor:` entry, especially one for a zone whose parent is insecure, using `grep -r trust-anchor /etc/unbound`","needs_analyst":true,"not_affected_if":["default-config","root-anchor-only"],"who_is_affected":"Only resolvers that have both the root trust anchor and an additional trust-anchor for a DNSSEC island under an insecure parent are exposed. An attacker must be able to deliver a forged response to the resolver, so resolvers reachable by untrusted network paths are the most at risk. Resolvers with only the default root trust anchor are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":3457,"output_tokens":679,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-50106':14A,17A '1.26.1':30B,88C 'actor':121C 'addit':99C 'anchor':38B,44B,96C,102C,154C 'attack':74B 'caus':162C 'chain':118C 'configur':33B,90C 'consecut':157C 'craft':58B 'cve':12A,15A 'deliv':124C 'deni':7A,76B,171C 'dns':2A,18B 'dnssec':19B,47B 'exist':78B,172C 'extra':41B 'forg':4A,54B,126C 'host':23B 'includ':29B,86C 'infrastructur':20B 'insecur':52B,71B,114C,143C,159C,169C 'insid':67B,132C 'instead':155C 'island':11A,48B,69B,106C,134C,178C 'island-of-secur':105C 'lab':81C 'make':62B 'malici':120C 'name':131C 'nlnet':80C 'nsec/soa':137C 'nxdomain':5A,55B,127C 'one':125C 'parent':50B,111C,144C,160C 'plus':39B 'provabl':113C 'record':8A,66B,164C,174C 'resolv':3A 'respons':128C 'root':36B,94C,117C,152C 'rrsig':59B,138C 'secur':108C 'self':22B 'self-host':21B 'set':140C 'signernam':60B,139C 'thus':161C 'treat':65B,167C 'trick':145C 'trust':10A,37B,43B,95C,101C,153C,177C 'trust-anchor':42B,100C 'unbound':1A,24B,25B,82C,146C 'use':150C 'valid':64B,148C 'version':87C 'whose':49B,110C 'zone':109C","nicknames":[],"mitigations":[],"who_affected":"Only resolvers that have both the root trust anchor and an additional trust-anchor for a DNSSEC island under an insecure parent are exposed. An attacker must be able to deliver a forged response to the resolver, so resolvers reachable by untrusted network paths are the most at risk. Resolvers with only the default root trust anchor are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"sep@nlnetlabs.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50106","severity":null,"published_at":"2026-10-21T09:17:07+00:00","modified_at":"2026-10-22T15:22:40+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-50106","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50106","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}