How severe is CVE-2026-12490?

CVE-2026-12490 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-12490 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-12490?

CVE-2026-12490 affects Nlnetlabs Nsd. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-12490?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-12490 have an EU (EUVD) identifier?

Yes. CVE-2026-12490 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39185.

When was CVE-2026-12490 published?

CVE-2026-12490 was published on 2026-06-25 and last updated on 2026-06-26.

CVE-2026-12490

CVE-2026-12490 is a high-severity vulnerability in Nlnetlabs Nsd with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-284.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 8.2
EPSS exploit prediction: 0% (11th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-39185
Weakness: CWE-284
Affected product: Nlnetlabs Nsd
Published: 2026-06-25
Last modified: 2026-06-26

Description

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

Frequently asked questions

What is CVE-2026-12490?: When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.
How severe is CVE-2026-12490?: CVE-2026-12490 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-12490 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-12490?: CVE-2026-12490 affects Nlnetlabs Nsd. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-12490?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-12490 have an EU (EUVD) identifier?: Yes. CVE-2026-12490 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39185.
When was CVE-2026-12490 published?: CVE-2026-12490 was published on 2026-06-25 and last updated on 2026-06-26.

References

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

Affected products (1)

cpe:2.3:a:nlnetlabs:nsd:*:*:*:*:*:*:*:*

More vulnerabilities in Nlnetlabs Nsd

CVE-2026-18664 — Critical (CVSS 9.1): When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP…
CVE-2026-12244 — High (CVSS 8.8): If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS…
CVE-2026-12246 — High (CVSS 8.1): NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the…
CVE-2026-19538 — High (CVSS 7.5): The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed…
CVE-2026-19401 — High (CVSS 7.5): Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted…
CVE-2026-18916 — High (CVSS 7.5): Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously…

All CVEs affecting Nlnetlabs Nsd →

Other CWE-284 (Improper Access Control) vulnerabilities

CVE-2026-83944 — Critical (CVSS 10.0): Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-20192 — Critical (CVSS 10.0): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine…
CVE-2026-87230 — Critical (CVSS 10.0): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The…
CVE-2026-54745 — Critical (CVSS 10.0): Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0,…
CVE-2026-18886 — Critical (CVSS 10.0): ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform.…
CVE-2026-76607 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.

Browse all CWE-284 (Improper Access Control) vulnerabilities →