CVE-2026-54478: NLnet Labs Unbound Auth Bypass Flaw

CVE-2026-54478 Overview

CVE-2026-54478 is an authentication weakness in NLnet Labs Unbound, a widely deployed validating, recursive, and caching DNS resolver. The flaw affects versions 1.18.0 through 1.25.1 when the resolver listens on a proxy-protocol-port interface with answer-cookie: yes enabled. Unbound computes the RFC 9018 server-cookie SipHash over the proxy's wire address rather than the PROXYv2-declared client address. A single valid server cookie obtained through a proxy node validates for every spoofed source behind that node. This bypasses the DNS Cookie defense that operators deployed specifically to defeat off-path spoofing attacks. The issue is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
An off-path attacker can harvest a valid server cookie with one legitimate query, then replay it under any spoofed source address behind the same proxy to bypass DNS Cookie protections on UDP.

Affected Products

NLnet Labs Unbound 1.18.0 through 1.25.1
Deployments configured with proxy-protocol-port interface
Deployments with answer-cookie: yes enabled on the proxy interface

Discovery Timeline

2026-07-22 - CVE-2026-54478 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-54478

Vulnerability Analysis

DNS Cookies, defined in RFC 7873 and updated by RFC 9018, provide a lightweight authentication mechanism between DNS clients and servers. The server derives its server cookie using SipHash over the client's IP address, a client-provided cookie, and a server secret. This binding to the client address is what prevents an off-path attacker from replaying a captured cookie under a spoofed source.

Unbound supports PROXYv2 to accept client connections through an intermediate load balancer or proxy. In PROXYv2 deployments, the true client address is carried in the PROXYv2 header while the underlying transport uses the proxy's address. On a vulnerable proxy-protocol-port interface, Unbound feeds the wire address into the SipHash computation rather than the PROXYv2-declared client address.

Root Cause

The root cause is an incorrect input to the server-cookie SipHash function. RFC 9018 requires binding the cookie to the true client identity. Unbound instead binds it to the proxy's transport address, which is identical for every request traversing that proxy node. This collapses the per-client authentication guarantee into a per-proxy guarantee.

Attack Vector

An off-path attacker issues one legitimate query through a UDP proxy front-end that forwards to Unbound with PROXYv2. Unbound returns a server cookie valid for the proxy's wire address. The attacker then sends UDP queries with spoofed source IP addresses through the same proxy, replaying the harvested cookie. Unbound accepts the cookie because SipHash validation uses the proxy address, not the spoofed PROXYv2 client address. The attacker regains the ability to conduct cache-poisoning and reflection attacks that DNS Cookies were meant to prevent. Refer to the NLnet Labs vulnerability disclosure for the authoritative technical description.

Detection Methods for CVE-2026-54478

Indicators of Compromise

Anomalous volumes of DNS queries carrying valid server cookies but originating from disparate PROXYv2-declared client addresses behind a single proxy node.
Cache-poisoning attempts or unexpected authoritative-referral traffic following legitimate cookie exchanges on proxy-protocol-port interfaces.
Unbound verbose logs showing cookie validation success for source addresses that should not have obtained a prior cookie.

Detection Strategies

Audit Unbound configuration for the coexistence of proxy-protocol-port and answer-cookie: yes on the same interface.
Correlate PROXYv2 client addresses with server-cookie issuance events to identify cookies reused across unrelated declared clients.
Monitor UDP query rates per PROXYv2-declared source and alert on burst patterns consistent with spoofed replay traffic.

Monitoring Recommendations

Enable Unbound query logging with PROXYv2 client attribution and forward logs to a centralized analytics platform for correlation.
Track cache-miss and referral-out ratios on proxy-protocol interfaces to identify poisoning attempts.
Baseline normal cookie-authenticated query distributions per proxy and alert on deviations.

How to Mitigate CVE-2026-54478

Immediate Actions Required

Upgrade Unbound to a fixed release published by NLnet Labs beyond version 1.25.1 as referenced in the vendor advisory.
Disable answer-cookie: yes on any interface that also uses proxy-protocol-port until the upgrade is applied.
Restrict which upstream proxies may connect to the proxy-protocol-port interface using firewall rules or interface-action ACLs.

Patch Information

NLnet Labs has published a security notice for CVE-2026-54478. Operators should review the official disclosure for the exact fixed version and change-log entries. Version 1.25.1 and earlier releases in the 1.18.0 line are affected.

Workarounds

Set answer-cookie: no on proxy-protocol-port interfaces to remove the invalid cookie-authentication path.
Terminate PROXYv2 on a TCP-only front-end so that UDP spoofing is not viable against the affected interface.
Limit the proxy tier to trusted clients using network segmentation and mutual TLS, reducing the pool of attackers able to reach the proxy-protocol-port listener.

bash

# Configuration example: disable DNS cookies on proxy-protocol interfaces
# /etc/unbound/unbound.conf
server:
    interface: 0.0.0.0@53
    proxy-protocol-port: 5353
    # Mitigation: do not answer cookies on proxy-protocol interfaces
    answer-cookie: no
    # Restrict who can send PROXYv2 to Unbound
    access-control: 10.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse