Vulnerability · Published Jun 25, 2026 · Assigned by NLnet Labs

CVE-2026-12490Bypass of client certificate verification with transfer over TLS

High 8.2

In plain English

A high-severity missing authentication in NSD from NLnet Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	nsd	4.14.3-r0	ALPINE-CVE-2026-12490
Debian:12	nsd	no fix listed	DEBIAN-CVE-2026-12490
Debian:13	nsd	no fix listed	DEBIAN-CVE-2026-12490
Debian:14	nsd	4.14.3-1	DEBIAN-CVE-2026-12490
Ubuntu:26.10	nsd	no fix listed	UBUNTU-CVE-2026-12490

Affected products (as reported)

Vendor	Product	Versions
NLnet Labs	NSD	4.10.1 – before 4.14.3

Weakness: CWE-306, CWE-284 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt vendor-advisory