# CVE-2026-50106: NLnet Labs Unbound DNS validator bypass in DNSSEC validation

Source: https://junglewise.ai/threats/cve-2026-50106-when-nlnet-labs-unbound-up-to-and-including-version-1-26-1-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-50106 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Unbound is a DNS resolver that validates the authenticity of DNS records using DNSSEC. A flaw in its validation logic allows an attacker to send a forged DNS response that tricks Unbound into treating a protected DNS zone as insecure, causing it to deny the existence of legitimate records and potentially redirecting traffic to attacker-controlled servers.

Technologies: [NLnet Labs Unbound](https://junglewise.ai/threats/technologies/unbound). Vendors: [NLnet Labs](https://junglewise.ai/threats/vendors/nlnet-labs).

## Quick answers

**Is CVE-2026-50106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50106 being exploited in the wild.

**How severe is CVE-2026-50106?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** NLnet Labs Unbound up to and including 1.26.1.

**Is there a fix for CVE-2026-50106?** Yes: fixed in 1.26.2. Until then: Upgrade to Unbound 1.26.2 or apply the patch manually using the provided patches from https://nlnetlabs.nl/downloads/unbound/ (either the full patch or the minimal security-only patch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50106 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50106?** Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.26.2

Upgrade to Unbound 1.26.2 or apply the patch manually using the provided patches from https://nlnetlabs.nl/downloads/unbound/ (either the full patch or the minimal security-only patch).

## Technical details

When Unbound is configured with both a root trust anchor and an additional trust-anchor for an island-of-security zone whose parent is provably insecure, a network attacker can deliver a forged NXDOMAIN response with NSEC/SOA RRSIG 'SignerName' set to the insecure parent. This tricks the validator into using the root trust anchor instead and treating records as insecure. The vulnerability requires DNSSEC configuration that includes both a root trust anchor and a separate trust anchor for a child zone with an insecure parent; a fix requiring secure denial proofs is available in version 1.26.2.

## Affected products

- NLnet Labs Unbound up to and including 1.26.1

## Timeline

- 2026-10-21: disclosed

## References

- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50106.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50106.txt)

## Related threats

- [NLnet Labs Unbound use-after-free in DNS-over-QUIC stream cleanup](https://junglewise.ai/threats/cve-2026-97206-nlnet-labs-unbound-1-22-0-up-to-and-including-version-1-26-1)
- [NLnet Labs Unbound DNS decompression CPU exhaustion](https://junglewise.ai/threats/cve-2026-96405-nlnet-labs-unbound-up-to-and-including-version-1-26-1-limits)
- [NLnet Labs Unbound cache side-channel in upstream source port probe](https://junglewise.ai/threats/cve-2026-109125-in-nlnet-labs-unbound-up-to-and-including-version-1-26-1-an)
- [NLnet Labs Unbound DNS complexity attacks via ReTrap](https://junglewise.ai/threats/cve-2026-85501-nlnet-labs-unbound-dns-complexity-attacks-via-retrap)
- [NLnet Labs Unbound use-after-free in DNS-over-HTTPs](https://junglewise.ai/threats/cve-2026-82720-nlnet-labs-unbound-use-after-free-in-dns-over-https)