Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T00:00:00 nsd: Bypass of client certificate verification with transfer over TLS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-303

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

A flaw was found in nsd. When a 'provide-xfr' is configured with a 'tls-auth-name', the server incorrectly allows zone transfers without requiring a client certificate if the request comes over TLS on the regular 'tls-port' or over TCP on the regular port, provided other access control conditions are met. This authentication bypass allows an attacker to perform unauthorized zone transfers, leading to information disclosure.

This flaw is rated as Moderate. The nsd DNS server, when configured for zone transfers with `provide-xfr` and `tls-auth-name`, can bypass client certificate verification. This allows unauthorized zone transfers and information disclosure if requests are made over the regular TLS or TCP port, as the `tls-auth-xfr-only` option is not enabled by default. This vulnerability doesn't affect any supported Red Hat Product. https://www.cve.org/CVERecord?id=CVE-2026-12490 https://nvd.nist.gov/vuln/detail/CVE-2026-12490