CVE-2026-55708

A flaw in Unbound's unbound-control utility can omit default-protected zones when initializing local data for a view. This allows queries for protected local names to bypass intended policies and leak to the public DNS, potentially exposing sensitive network information.

This is a Low impact flaw in Unbound. A highly privileged user, by using unbound-control to create a view without initial local data, can cause queries for internal network names to be sent to public DNS servers. This bypasses local policy and could lead to the disclosure of internal network information.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run unbound-control view_local_data / view_local_datas on named views that started with no local-data; put local-data (or the RFC 1918 / AS112 / .onion / .localhost local-zones) in unbound.conf so the tree is built at startup with the defaults. If views or remote control are unused, leave control-enable: no and keep the control socket admin-only. Block Unbound from sending those names to the public Internet.