CVE-2026-50248: NLnet Labs Unbound Auth Bypass Vulnerability

CVE-2026-50248 Overview

CVE-2026-50248 affects NLnet Labs Unbound versions 1.7.0 through 1.25.1. The vulnerability resides in the handling of authoritative (auth) and Response Policy Zone (rpz) configurations. When a configured primary hostname resolves to a BOGUS A or AAAA record, Unbound still treats that address as a valid zone transfer (XFR) endpoint. An attacker who can spoof the primary hostname's A/AAAA record, without providing a valid RRSIG, can become the zone's XFR primary. This allows the attacker to replace the entire zone contents or the resolver's response policy [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
An attacker able to spoof DNS responses for a zone's primary hostname can hijack XFR operations and rewrite Unbound's authoritative or RPZ data, subverting resolver policy for all downstream clients.

Affected Products

NLnet Labs Unbound 1.7.0 through 1.25.1
Deployments using auth-zone configurations with hostname-based primaries
Deployments using rpz (Response Policy Zone) with hostname-based primaries

Discovery Timeline

2026-07-22 - CVE-2026-50248 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-50248

Vulnerability Analysis

Unbound supports fetching zones from configured primaries defined by hostname rather than fixed IP address. During zone refresh, Unbound resolves the primary's hostname to A and AAAA records and initiates an XFR against the returned addresses. The defect is that Unbound does not reject addresses whose DNSSEC validation state is BOGUS. Records failing validation are treated as usable XFR endpoints.

An attacker positioned to spoof the primary hostname's A or AAAA response can inject arbitrary IP addresses without needing a valid RRSIG. Because the resolver proceeds to request the zone from the attacker-controlled address, the attacker delivers a fabricated zone. For auth-zone this replaces authoritative answers; for rpz it replaces the policy that controls filtering and rewriting.

Root Cause

The root cause is missing DNSSEC validation enforcement on primary hostname resolution results. Unbound's XFR primary selection logic accepts A/AAAA records regardless of whether their validation outcome is SECURE, INSECURE, or BOGUS. The security-critical decision, choosing which host to trust for zone data, uses unverified address data.

Attack Vector

Exploitation requires the attacker to spoof or inject A/AAAA responses for the primary hostname configured in Unbound. This is feasible for on-path attackers, operators of upstream authoritative servers for the hostname's parent zone, or attackers exploiting cache poisoning primitives. No valid RRSIG is required. After the resolver caches the malicious address, Unbound issues an XFR request that the attacker answers with a crafted zone file, taking over the zone or RPZ contents until the next successful refresh from a legitimate source. The attack complexity is high because the attacker must win the resolution race and control the XFR response.

Detection Methods for CVE-2026-50248

Indicators of Compromise

Unexpected changes to auth-zone or rpz contents that do not match the legitimate primary's serial or SOA record.
XFR (AXFR/IXFR) traffic from Unbound to IP addresses that are not on the operator's list of approved primaries.
DNSSEC validation log entries showing BOGUS results for primary hostnames immediately preceding a zone refresh.
Sudden shifts in RPZ-driven blocking or rewriting behavior affecting downstream clients.

Detection Strategies

Parse Unbound logs for xfr and auth zone events, correlating remote IPs against an allowlist of known primary addresses.
Monitor DNSSEC validation counters and log lines referencing BOGUS responses for hostnames used in auth-zone or rpz primary definitions.
Compare zone serial numbers and record counts against the legitimate primary via out-of-band checks.

Monitoring Recommendations

Capture outbound TCP/53 and TCP/853 flows from resolvers and alert on connections to unapproved destinations.
Track RPZ hit-rate deltas and unusual NXDOMAIN or CNAME-rewrite patterns that could indicate policy replacement.
Ingest Unbound operational logs into a centralized log platform and alert on zone-refresh anomalies.

How to Mitigate CVE-2026-50248

Immediate Actions Required

Inventory all Unbound instances running 1.7.0 through 1.25.1 that use auth-zone or rpz with hostname-based primaries.
Replace hostname-based primary definitions with static IP addresses for zones sourced over untrusted paths until patched.
Verify the integrity of current auth-zone and rpz data by comparing against the authoritative source.
Restrict Unbound's outbound XFR traffic to an explicit allowlist of primary IP addresses at the network layer.

Patch Information

Refer to the NLnet Labs advisory for CVE-2026-50248 for the fixed version and upgrade instructions. Operators should upgrade to the vendor-supplied fixed release once available and restart the Unbound service to apply the change.

Workarounds

Configure primaries using literal IP addresses instead of hostnames in auth-zone and rpz blocks.
Sign the primary hostname's zone with DNSSEC and enforce validation upstream to reduce spoofing feasibility.
Apply firewall egress rules that permit XFR only to trusted primary IPs, blocking attacker-controlled endpoints even if spoofing succeeds.

bash

# Example: pin auth-zone primary to a literal IP instead of a hostname
auth-zone:
    name: "example.com."
    primary: 192.0.2.53
    primary: 2001:db8::53
    for-downstream: yes
    for-upstream: yes
    zonefile: "example.com.zone"