CVE-2026-50248 describes an insufficient verification of data authenticity vulnerability (CWE-345) in NLnet Labs Unbound DNS resolver versions 1.7.0 up to and including 1.25.1. When an authoritative or response policy zone (auth/rpz) is configured with a primary hostname that resolves to BOGUS A/AAAA DNS records, Unbound incorrectly still considers this hostname as a valid transfer (XFR) endpoint. This flaw allows a malicious actor capable of spoofing the A/AAAA DNS records for that hostname—without requiring valid DNSSEC signatures (RRSIG)—to impersonate the zone's primary XFR server. Consequently, the attacker can replace the entire zone data or the resolver's response policy, potentially altering DNS responses.

The vulnerability allows an unauthenticated attacker to spoof DNS A/AAAA records for a configured primary hostname that resolves to BOGUS records, thereby becoming the zone's XFR primary server. This enables the attacker to replace the entire zone or the resolver's response policy data. The impact is integrity loss of DNS data served by Unbound, potentially leading to malicious DNS responses. Confidentiality is not affected, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, administrators should avoid configuring auth/rpz zones with primary hostnames that resolve to BOGUS A/AAAA records or implement network-level protections to prevent DNS spoofing of these hostnames.