CVE-2026-55708: NLnet Labs Unbound Information Disclosure

CVE-2026-55708 Overview

CVE-2026-55708 affects NLnet Labs Unbound, an open-source recursive DNS resolver. Versions 1.6.0 through 1.25.1 are affected. The vulnerability resides in the view_local_data and view_local_datas commands of unbound-control. When an operator uses these commands to add local data to a configured named view that had no local data defined, Unbound creates a bare local zone tree without the default-protected zones. Queries for names normally covered by defaults, such as RFC 1918 reverse zones, AS112 zones, .onion, and .localhost, escape to the public DNS instead of being answered locally.

Critical Impact
Clients mapped to affected views can leak sensitive internal DNS queries to upstream resolvers, bypassing local policy expectations.

Affected Products

NLnet Labs Unbound 1.6.0 through 1.25.1
Deployments using named views configured without local data
Systems relying on unbound-control to inject local data at runtime

Discovery Timeline

2026-07-22 - CVE CVE-2026-55708 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-55708

Vulnerability Analysis

Unbound supports named views that let operators apply distinct DNS policies to different client groups. Views can include local zones and local data that override recursion for specific names. By default, Unbound installs a set of protected zones covering RFC 1918 reverse space, AS112, .onion, .localhost, and other names the resolver should not send to the public internet.

When a view is defined without any local data, its local zone tree is not initialized at startup. Invoking view_local_data or view_local_datas through unbound-control triggers on-demand creation of that tree. The creation path omits the default-protected zones that the normal configuration loader would have inserted. The resulting tree contains only the operator-supplied entries.

As a consequence, any client mapped to the affected view issues queries for default-protected names that fall through to the iterator. Reverse lookups for internal IPv4 ranges, .onion addresses from Tor clients, and .localhost probes reach upstream servers. This violates the local policy expectation that Unbound blocks or answers these names locally. The weakness is categorized as [CWE-1188] Initialization of a Resource with an Insecure Default.

Root Cause

The control interface path that lazily allocates the view's local zone tree does not replicate the default zone insertion performed by the configuration parser. A missing initialization step causes the tree to exist in a partially populated state that differs from the state produced when local data is declared in the configuration file.

Attack Vector

Exploitation requires local access with high privileges to run unbound-control against the resolver, plus operator action to add view local data at runtime. The impact is realized by any downstream client mapped to the affected view once queries begin leaking. No memory corruption or code execution occurs; the effect is a policy bypass and information disclosure through DNS query leakage.

The vulnerability is described in prose only. Refer to the NLnet Labs CVE-2026-55708 Advisory for authoritative technical details.

Detection Methods for CVE-2026-55708

Indicators of Compromise

Outbound DNS queries from the Unbound host targeting RFC 1918 reverse zones (10.in-addr.arpa, 168.192.in-addr.arpa, 16.172.in-addr.arpa through 31.172.in-addr.arpa).
Recursive resolution attempts for .onion, .localhost, .invalid, or .test names originating from the resolver.
Runtime use of unbound-control view_local_data or view_local_datas in shell history or audit logs against views that lacked local data in the base configuration.

Detection Strategies

Compare the running local zone tree per view using unbound-control view_list_local_zones against expected defaults documented in the Unbound manual.
Enable Unbound query logging and alert on responses returned via the iterator for names inside default-protected zones.
Correlate unbound-control invocations with subsequent changes in upstream DNS egress volume.

Monitoring Recommendations

Forward Unbound query logs to a centralized log platform and build alerts for default-protected suffixes leaving the resolver.
Baseline outbound DNS traffic from resolvers and flag deviations following configuration changes.
Audit shell history and configuration management logs for use of the affected unbound-control subcommands.

How to Mitigate CVE-2026-55708

Immediate Actions Required

Upgrade Unbound to a version later than 1.25.1 that includes the fix from NLnet Labs once available.
Inventory all named views and identify those configured without local-data entries in unbound.conf.
Restrict access to unbound-control to trusted administrators and protect the control socket with strict file permissions.

Patch Information

Refer to the NLnet Labs CVE-2026-55708 Advisory for the fixed version and upstream patch commits. Apply the vendor-supplied build once released and restart the resolver.

Workarounds

Declare at least one local-data entry in unbound.conf for every view so the local zone tree is initialized at startup with the default-protected zones.
Explicitly configure the default-protected zones inside each view using view-first: yes combined with local-zone statements for RFC 1918 reverse space, AS112, .onion, and .localhost.
Avoid using view_local_data and view_local_datas through unbound-control on views that were started without local data; restart Unbound with an updated configuration file instead.

bash

# Configuration example: pre-populate a view with defaults
view:
    name: "internal-clients"
    view-first: yes
    local-zone: "10.in-addr.arpa." static
    local-zone: "16.172.in-addr.arpa." static
    local-zone: "168.192.in-addr.arpa." static
    local-zone: "onion." static
    local-zone: "localhost." static
    local-data: "placeholder.internal. IN A 192.0.2.1"