---
id: "CVE-2026-50106"
kind: "vulnerability"
aliases: ["CVE-2026-50106"]
title: "Unbound DNS resolver: forged NXDOMAIN can deny records in trust islands"
severity: "medium"
cvss: 6.5
epss: 0.00194
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dns", "dnssec", "infrastructure", "self-hosted", "unbound"]
not_affected_if: ["default-config", "root-anchor-only"]
published_at: "2026-10-21T09:17:07+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:49:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50106", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-50106", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Unbound DNS resolver: forged NXDOMAIN can deny records in trust islands

Unbound up to and including 1.26.1 can be configured with a root trust anchor plus an extra trust-anchor for a DNSSEC island whose parent is insecure. A forged NXDOMAIN with a crafted RRSIG SignerName can make the validator treat records inside that island as insecure, so an attacker can deny their existence.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `unbound -V` to read the installed version and confirm it is `1.26.1` or older
- Check the config for more than one `trust-anchor:` entry, especially one for a zone whose parent is insecure, using `grep -r trust-anchor /etc/unbound`

## Fix

- Upgrade Unbound to a release newer than `1.26.1`; the sources do not name the fixed version
- Remove the extra island `trust-anchor:` if it is not needed

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50106
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-50106

## From the sources

When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name inside the island, with the NSEC/SOA RRSIG 'SignerName' set to the insecure parent, tricks Unbound's validator to use the root trust anchor instead, and consecutively the insecure parent, thus causing that record to be treated as insecure and denying existence for records in the trust island.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_