CVE-2026-18664: NSD Access Control Auth Bypass Vulnerability

CVE-2026-18664 Overview

CVE-2026-18664 is an access control flaw in NSD (Name Server Daemon) affecting IP range comparisons on little-endian systems. When administrators configure access control using IP ranges of the form 1.2.3.4-1.2.3.25, NSD compares addresses using host byte order while the values are stored in network byte order. This mismatch causes incorrect range evaluation, so IPs intended to be allowed may be denied and IPs intended to be denied may be allowed. The flaw is tracked as [CWE-284: Improper Access Control].

Critical Impact
Attackers may reach NSD services from source addresses that administrators explicitly blocked, undermining zone transfer and query restrictions on authoritative DNS servers.

Affected Products

NLnet Labs NSD (Name Server Daemon) on little-endian host architectures
Deployments using IP range syntax (start-end) in access control lists
Both IPv4 and IPv6 range access control configurations

Discovery Timeline

2026-08-26 - CVE-2026-18664 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18664

Vulnerability Analysis

NSD implements host-based access control that supports IP ranges expressed as start-end. The comparison logic treats IPv4 addresses as unsigned 32-bit integers and evaluates whether the source address falls between the range endpoints. On little-endian systems, NSD performs this comparison using the native host byte order, while the underlying IP values remain in network byte order (big-endian). The two representations do not order equivalently, so the arithmetic comparison produces incorrect results.

The same defect applies to IPv6 addresses. NSD compares IPv6 addresses as four sequential unsigned 32-bit integers, again using host byte order against values stored in network byte order. Ranges that appear valid in configuration may permit or reject addresses inconsistently with administrator intent.

The practical result is a broken security boundary. Access control lists that rely on IP ranges cannot be trusted on little-endian hardware, which includes the vast majority of modern x86_64 and ARM deployments running authoritative DNS infrastructure.

Root Cause

The root cause is a byte-order mismatch. Network protocols transmit IP addresses in big-endian format, and system libraries preserve that ordering in the in_addr and in6_addr structures. NSD's range comparison routine reads these values and performs numeric comparison without converting to host byte order first. On big-endian hosts the two representations happen to align, so the bug is invisible there.

Attack Vector

An unauthenticated remote attacker sends DNS queries or zone transfer requests to an NSD instance from a source address that the administrator intended to block. Because the range comparison misorders the octets, an address outside the intended allowlist can satisfy the flawed comparison and reach the service. Conversely, legitimate operators may lose access without warning, producing operational impact in addition to the security concern.

No authentication, user interaction, or local access is required. Exploitation depends on the specific numeric relationship between the attacker's IP address and the configured range boundaries after byte reordering.

No public exploit code or proof-of-concept has been published. See the NLnet Labs CVE-2026-18664 Advisory for vendor technical details.

Detection Methods for CVE-2026-18664

Indicators of Compromise

Successful DNS queries or AXFR/IXFR zone transfer requests in NSD logs originating from source IPs that fall outside documented allowlists.
Denied queries from operator IP addresses that should match a configured allow range.
Discrepancies between the intended ACL and the effective behavior observed during connectivity tests against NSD.

Detection Strategies

Audit nsd.conf for any acl or provide-xfr entries that use IP range syntax (start-end) rather than CIDR notation.
Perform active validation by issuing queries from IPs at each end of every configured range and comparing observed behavior to intended policy.
Correlate NSD query logs with firewall and network flow data to identify traffic that reached NSD from addresses that should have been blocked.

Monitoring Recommendations

Enable verbose NSD query logging on authoritative servers and forward logs to a centralized analytics platform for review.
Alert on zone transfer requests from unexpected source addresses, particularly outside documented secondary name server ranges.
Track configuration changes to NSD access control files and trigger validation tests whenever ranges are modified.

How to Mitigate CVE-2026-18664

Immediate Actions Required

Inventory all NSD deployments and identify configurations that use IP range syntax in access control statements.
Replace IP range entries with CIDR notation wherever possible, since CIDR-based matching is not affected by this defect.
Apply the vendor-supplied patch for NSD as soon as it is available from NLnet Labs.
Restrict network access to NSD at the firewall or host level as a defense-in-depth measure until patching is complete.

Patch Information

Refer to the NLnet Labs CVE-2026-18664 Advisory for fixed version information and patch details. Operators running NSD on little-endian architectures should prioritize the update.

Workarounds

Convert every IP range in nsd.conf to one or more equivalent CIDR blocks to avoid the affected comparison path.
Enforce source IP filtering upstream using stateful firewalls, network ACLs, or iptables rules that operate on properly ordered addresses.
Limit exposure of authoritative NSD instances to management networks and known secondary name server addresses only.

bash

# Configuration example: replace range syntax with CIDR in nsd.conf
# Vulnerable form (uses range comparison affected by CVE-2026-18664):
#   acl: 192.0.2.10-192.0.2.20 NOKEY
#
# Preferred form (uses CIDR, not affected):
#   acl: 192.0.2.0/28 NOKEY
#
# Validate configuration after edits:
nsd-checkconf /etc/nsd/nsd.conf
systemctl reload nsd