CVE-2026-55708: CWE-1188: Initialization of a Resource with an Insecure Default in NLnet Labs Unbound
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
AI Analysis
Technical Summary
In NLnet Labs Unbound versions 1.6.0 through 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for a named view configured without local data. However, this creation process omits adding default-protected zones such as RFC 1918 reverse zones, AS112 zones, .onion, and .localhost. As a result, queries for these default-protected names from clients mapped to that view are forwarded to the public DNS via the iterator instead of being answered locally, thereby bypassing expected local DNS policy protections. This issue is classified under CWE-1188 (Initialization of a Resource with an Insecure Default).
Potential Impact
The vulnerability allows DNS queries for default-protected names to escape local resolution and be sent to public DNS servers, potentially violating local DNS policy expectations. This could lead to unintended information disclosure or policy bypass. However, exploitation requires high privileges and user interaction, and the impact on confidentiality and integrity is limited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor NLnet Labs advisories for updates. Until a fix is available, avoid using the affected 'unbound-control' commands in environments where local zone policy enforcement is critical or restrict access to these commands to trusted administrators only.
CVE-2026-55708: CWE-1188: Initialization of a Resource with an Insecure Default in NLnet Labs Unbound
Description
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
CVSS v3.1
Score 3.1low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In NLnet Labs Unbound versions 1.6.0 through 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for a named view configured without local data. However, this creation process omits adding default-protected zones such as RFC 1918 reverse zones, AS112 zones, .onion, and .localhost. As a result, queries for these default-protected names from clients mapped to that view are forwarded to the public DNS via the iterator instead of being answered locally, thereby bypassing expected local DNS policy protections. This issue is classified under CWE-1188 (Initialization of a Resource with an Insecure Default).
Potential Impact
The vulnerability allows DNS queries for default-protected names to escape local resolution and be sent to public DNS servers, potentially violating local DNS policy expectations. This could lead to unintended information disclosure or policy bypass. However, exploitation requires high privileges and user interaction, and the impact on confidentiality and integrity is limited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor NLnet Labs advisories for updates. Until a fix is available, avoid using the affected 'unbound-control' commands in environments where local zone policy enforcement is critical or restrict access to these commands to trusted administrators only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NLnet Labs
- Date Reserved
- 2026-06-22T12:27:22.800Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60c4229c2644c7f80e9250
Added to database: 07/22/2026, 13:22:42 UTC
Last enriched: 07/22/2026, 13:38:56 UTC
Last updated: 07/22/2026, 15:40:34 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.