Vulnerability allows an attacker to perform zone transfers without client certificate authentication when using the provider transfer mechanism over the server’s standard TLS address or an unencrypted TCP connection, as long as the request satisfies the provide‑xfr rule with a tls-auth-name. The flaw arises from missing authentication checks and improper access control (CWE-284, CWE-306, and CWE-303), enabling the disclosure of private DNS zone data.

Affects NLnet Labs NSD 4.14.x and earlier. Versions prior to 4.14.3 are vulnerable; upgrade is required. Without patch or configuration changes, an NSD deployment that includes a provide‑xfr rule with a tls-auth-name can expose zone data to unauthenticated clients.

The CVSS score of 8.2 signifies high severity. The EPSS score of < 1% indicates a low exploitation probability, but the lack of a certificate requirement implies that remote attackers who can reach the server’s port can exploit easily. The vulnerability is not listed in CISA KEV; nevertheless, it presents a serious threat to the confidentiality of DNS information. Attackers can trigger the bypass over the normal TLS or standard TCP ports, enabling an unauthenticated zone transfer if a matching provide‑xfr rule is configured.