CVE-2026-12490

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284CWE-306

Affected software

VendorProductVersions
NLnet LabsNSD>= 4.10.1, < 4.14.3

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1249009.6Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124901Other issue in the Networking: JAR component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, ThunderbirCVE-2026-124902Same-origin policy bypass due to race condition in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.4CVE-2026-1249039.6Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.CVE-2026-1249048.8Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-124905Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, ThunderCVE-2026-1249068.8Use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThCVE-2026-1249078.8Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 1CVE-2026-1249088.8Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1249094.3Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, aCVE-2026-124914.8A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of imaCVE-2026-124910Mitigation bypass in the WebExtensions component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thund
CVE-2026-12490: High severity, CVSS 7.5 | Vulnix