Quick answers
- Is CVE-2026-50106 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50106 being exploited in the wild.
- How severe is CVE-2026-50106?
- Medium severity, with a CVSS score of 6.5, published 21 October 2026.
- Which products and versions are affected?
- NLnet Labs Unbound up to and including 1.26.1.
- Is there a fix for CVE-2026-50106?
- Yes: fixed in 1.26.2. Until then: Upgrade to Unbound 1.26.2 or apply the patch manually using the provided patches from https://nlnetlabs.nl/downloads/unbound/ (either the full patch or the minimal security-only patch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-50106 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-50106?
- Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.26.2
Upgrade to Unbound 1.26.2 or apply the patch manually using the provided patches from https://nlnetlabs.nl/downloads/unbound/ (either the full patch or the minimal security-only patch).
Technical details
When Unbound is configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is provably insecure, a network attacker can deliver a forged NXDOMAIN response with NSEC/SOA RRSIG 'SignerName' set to the insecure parent. This tricks the validator into using the root trust anchor instead and treating records as insecure. The vulnerability requires DNSSEC configuration that includes both a root trust anchor and a separate trust anchor for a child zone with an insecure parent; a fix requiring secure denial proofs is available in version 1.26.2.
Affected products
- NLnet Labs Unbound up to and including 1.26.1
Timeline
- 2026-10-21: disclosed