CVE-2026-78301: BIND DNS Server SSRF Vulnerability

CVE-2026-78301 Overview

CVE-2026-78301 affects ISC BIND 9 authoritative and recursive name servers. A malformed zone containing an NS or DNAME node above its origin causes named to treat that node as a zone cut. When an attacker introduces such a zone into an authoritative server, queries for names inside the configured zone lose authoritative status and return an out-of-zone delegation. A server that also provides recursion can follow the locally sourced cut and cache attacker-supplied data for names outside the configured zone. The condition persists as long as the malformed zone remains in the zone database, enabling sustained DNS cache poisoning [CWE-349].

Critical Impact
Attackers with the ability to insert a malformed zone can poison the recursive resolver cache with data for names outside the configured zone, undermining DNS integrity.

Affected Products

ISC BIND 9 versions 9.11.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25
ISC BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1

Discovery Timeline

2026-09-16 - CVE-2026-78301 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78301

Vulnerability Analysis

The flaw lies in how named processes zone content during loading and query resolution. A well-formed zone must not contain NS or DNAME records at names above the zone's configured origin. When such records appear, named incorrectly interprets them as a zone cut, which is a delegation boundary within DNS. Queries for legitimate names inside the configured zone then fall through the cut and are answered as delegations rather than authoritative answers. On a hybrid authoritative-and-recursive server, the recursion path follows this cut and treats attacker-supplied records as valid referral data, caching the results. This behavior violates the trust boundary between separate zones and enables data outside the malicious zone to be replaced in cache.

Root Cause

The root cause is improper validation of zone content boundaries. named accepts NS and DNAME nodes above the origin instead of rejecting the zone as malformed, and its resolver logic follows these bogus zone cuts. The condition maps to CWE-349, Acceptance of Extraneous Untrusted Data With Trusted Data, because attacker-controlled records are combined with legitimate authoritative content.

Attack Vector

Exploitation requires an attacker to place a malformed zone into the target server's zone database. The advisory identifies zone transfer as one insertion path. Because the attack requires the ability to supply zone data, exploitation prerequisites are elevated, but the impact extends to any recursive client of the affected server. The malformed zone continues to poison responses until it is removed. See the ISC CVE-2026-78301 Documentation for the vendor's technical breakdown.

No public exploit code is available. Refer to the vendor advisory for technical details of the parsing and delegation-handling defect.

Detection Methods for CVE-2026-78301

Indicators of Compromise

Zone files or transferred zones that contain NS or DNAME records at owner names above the zone $ORIGIN.
Recursive resolver cache entries for external domains sourced from a local authoritative zone.
Client queries for in-zone names receiving referral (AA=0) responses instead of authoritative answers.

Detection Strategies

Audit all loaded zones with named-checkzone and inspect record owner names for entries outside the configured origin.
Compare recursive resolver responses for external domains against a trusted upstream to identify divergent answers.
Review named query logs for delegations returned from zones that should answer authoritatively.

Monitoring Recommendations

Alert on successful inbound zone transfers from sources not on an allowlist.
Monitor cache contents on hybrid authoritative-and-recursive resolvers for records whose owner name is outside any locally hosted zone.
Track named reload and zone-load events, correlating with subsequent anomalies in resolution behavior.

How to Mitigate CVE-2026-78301

Immediate Actions Required

Upgrade to a fixed BIND 9 release: ISC BIND 9.20.29 or ISC BIND 9.21.26, or the corresponding Supported Preview Edition build.
Separate authoritative and recursive roles onto distinct named instances to eliminate the local cache-poisoning path.
Restrict allow-transfer and allow-update to trusted sources only, using TSIG-authenticated peers where possible.

Patch Information

ISC has released fixed builds. Consult the ISC CVE-2026-78301 Documentation for the complete list of patched versions and upgrade guidance. Administrators running BIND 9.11.x through 9.18.50 should plan migration to a supported branch, as those releases fall outside the ongoing maintenance window.

Workarounds

Disable recursion on servers that also host authoritative zones by setting recursion no; in named.conf.
Validate every zone with named-checkzone -i full before loading and reject zones containing records above the origin.
Remove any suspect zone from the database immediately; the poisoning persists only while the malformed zone remains loaded.

bash

# Configuration example
// Separate roles: authoritative-only server
options {
    recursion no;
    allow-transfer { key "transfer-key"; };
    allow-query { any; };
};

// Validate zones before loading
// named-checkzone -i full example.com /var/named/example.com.zone