The vulnerability CVE-2026-12490 in NLnet Labs NSD 4.10.1 arises because the server does not enforce client certificate authentication when a provide-xfr rule specifies a tls-auth-name, if the request is made over TLS on the standard TLS port or over TCP on the standard port. This bypass of the intended client certificate check constitutes missing authentication for a critical function (CWE-306). The CVSS 4.0 score of 8.2 reflects a high-severity network attack vector requiring high attack complexity but no privileges or user interaction, with high impact on confidentiality.

An attacker can potentially request zone transfers without providing the required client certificate authentication if connecting over the regular TLS or TCP ports, bypassing intended authentication controls. This could lead to unauthorized disclosure of DNS zone data, impacting confidentiality of the DNS infrastructure managed by NSD 4.10.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by NLnet Labs as of the data provided. Until a patch is available, administrators should consider restricting access to the NSD server ports or implementing network-level controls to limit unauthorized transfer requests.