CVE-2026-12490 | When a provide-xfr is given with a tls-auth-name, a secondar… | CVSS 8.2 HIGH

Description

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

Metadata

CVE ID: CVE-2026-12490
State: PUBLISHED
Assigner: NLnet Labs
Reserved: 2026-06-17 06:44 UTC
Published: 2026-06-25 05:24 UTC
Last updated: 2026-06-25 05:24 UTC
Primary CWE: CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product: NLnet Labs / NSD
Sources: cve.org · NVD

Severity & Metrics

8.2 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
NLnet Labs	NSD	—	4.10.1 < 4.14.3

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284: Improper Access Control
CWE-306	cna	CWE-306: Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.2	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (1)

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt