Unbound versions 1.0.1 through 1.26.1 can be misled when a zone configured as a trust island appears under an insecure parent. A forged NSEC record sent by an attacker, with the SOA bit cleared, is accepted by the validator and stored in the cache, bypassing RRSIG validation. The result is that a compromised trust anchor can be treated as insecure, undermining DNSSEC’s authenticity guarantees for queries that rely on that anchor.

NLnet Labs Unbound, specifically versions 1.0.1 up to and including 1.26.1 when configured with both a root trust anchor and an additional trust‑anchor for an island zone whose parent chain is insecure. Any system deploying such a configuration is vulnerable.

The CVSS score of 3.7 indicates a low severity vulnerability, and the EPSS score of "<1%" signals a very low exploitation likelihood in the general population. The issue is not yet listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote adversary who can send forged NSEC responses to the Unbound server, for example via compromised upstream resolvers or directly if the server is exposed to the Internet. Successful exploitation would allow the attacker to subvert the trust anchor, but the overall risk is mitigated by the low CVSS and exploitation probability.