Unbound versions up to 1.26.1 can be tricked into treating legitimate records as insecure when a root trust anchor and an island‑of‑security zone with an insecure parent are configured. A malicious actor who can deliver a forged NXDOMAIN response for an address inside the island, setting the NSEC/SOA RRSIG SignerName to the insecure parent, forces Unbound’s validator to fall back to the root trust anchor and subsequently the insecure parent. The result is that the record is considered non‑existent, effectively denying valid queries and corrupting the integrity of DNS validation.

NLnet Labs Unbound. All installations using version 1.26.1 or earlier that are configured with both a root trust anchor and an additional trust-anchor for an island‑of‑security zone whose parent is insecure under the root chain are affected.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of <1% reflects a very low but non‑zero likelihood that the vulnerability is actively exploited. Since the vulnerability is not listed in CISA’s KEV catalog, there is no known mass exploitation. Exposing the DNS server to spoofed NXDOMAIN responses is required, so the attack vector is likely a network‑controlled environment or an insider capable of sending forged responses. Consequently, while the potential impact is moderate, the real‑world risk is limited by the need for direct or privileged network access to the Unbound instance.