CVE-2026-55708: Privacy/configuration issue when adding local data in views through 'unbound-control'
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.
Other sources
Privacy/configuration issue when adding local data in views through 'unbound-control'
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.25.2-1 - Upgrade
Upgrade
NLnet Labs Unboundto a version that resolves this vulnerability.Fixed in 1.25.2 - Compensating control
After creating local data in a named view via unbound-control (using view_local_data/view_local_datas), ensure the default-protected local zones are present so that default-protected names (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost) are answered locally rather than escaping to public DNS via the iterator.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55708?
The severity of CVE-2026-55708 is rated as low with a score of 3.1.
How do I fix CVE-2026-55708?
To mitigate CVE-2026-55708, ensure that local data is properly configured before using the 'view_local_data' and 'view_local_datas' commands in unbound-control.
What are the potential impacts of CVE-2026-55708?
CVE-2026-55708 may lead to configuration issues that can expose local zone data in unintended ways.
In which versions of Unbound is CVE-2026-55708 present?
CVE-2026-55708 affects NLnet Labs Unbound versions 1.6.0 up to and including 1.25.1.
What type of issue is identified in CVE-2026-55708?
CVE-2026-55708 is classified as a privacy/configuration issue related to the handling of local data in views.