Description
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
Published: 2026-07-22
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Unbound 1.6.0 through 1.25.1, the commands "view_local_data" and "view_local_datas" in unbound-control create an empty local zones tree for a configured named view that has no local data. The creation omits the default‑protected zones such as RFC 1918 reverse, AS112, .onion, and .localhost. Consequently, any query for a protected name from a client mapped to that view bypasses the intended local zone handling and is forwarded upstream, allowing external resolution of internal or reserved domain names. This leaks query information and defeats local policy expectations.

Affected Systems

The vulnerability affects NLnet Labs Unbound versions 1.6.0 through 1.25.1 inclusive. Managing a named view via the unbound-control interface on these releases exposes the issue.

Risk and Exploitability

The CVSS score of 3.1 classifies the risk as low, and the EPSS score is documented as less than 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need either local or privileged access to the unbound-control interface to provoke the problematic view creation. While the likelihood of exploitation is low to moderate, the impact on privacy and policy compliance warrants prompt remediation.

Generated by OpenCVE AI on August 3, 2026 at 23:45 UTC.

Remediation

Vendor Solution

This issue is fixed starting with version 1.25.2

OpenCVE Recommended Actions

  • Upgrade Unbound to version 1.25.2 or later
  • Reconfigure named views to include local data so that the default‑protected zones are populated
  • Restrict access to the unbound-control interface to trusted administrators only to limit accidental view creation
  • If an upgrade is not immediately possible, manually add the default‑protected zones or disable unbound-control to prevent creation of bare zone trees

Generated by OpenCVE AI on August 3, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nlnetlabs
Nlnetlabs unbound
Vendors & Products Nlnetlabs
Nlnetlabs unbound

Wed, 22 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
Title Privacy/configuration issue when adding local data in views through 'unbound-control'
Weaknesses CWE-1188
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Nlnetlabs Unbound
cve-icon MITRE

Status: PUBLISHED

Assigner: NLnet Labs

Published:

Updated: 2026-07-22T14:10:36.937Z

Reserved: 2026-06-22T12:27:22.800Z

Link: CVE-2026-55708

cve-icon Vulnrichment

Updated: 2026-07-22T14:10:27.732Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T14:17:21.403

Modified: 2026-07-24T14:24:10.027

Link: CVE-2026-55708

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:00:09Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default