new file mode 100644
@@ -0,0 +1,51 @@
+From 1138101d9147db0539c27e9c19525223f32de84c Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:17:10 +0200
+Subject: [PATCH] - Fix CVE-2026-55708, Privacy/configuration issue when adding
+ local data in views through 'unbound-control'. Thanks to Qifan Zhang,
+ Palo Alto Networks, for the report.
+
+(cherry picked from commit c29ff70f6aa9bb2f02e5f21001832f2b4791bd76)
+
+CVE: CVE-2026-55708
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/c29ff70f6aa9bb2f02e5f21001832f2b4791bd76]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ daemon/remote.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/daemon/remote.c b/daemon/remote.c
+index d8ee7fa7d..8a26dadc7 100644
+--- a/daemon/remote.c
++++ b/daemon/remote.c
+@@ -1634,6 +1634,14 @@ do_view_data_add(RES* ssl, struct worker* worker, char* arg)
+ ssl_printf(ssl,"error out of memory\n");
+ return;
+ }
++ if(!v->isfirst) {
++ /* Global local-zone is not used for this view,
++ * therefore add defaults to this view-specific
++ * local-zone. */
++ struct config_file lz_cfg;
++ memset(&lz_cfg, 0, sizeof(lz_cfg));
++ local_zone_enter_defaults(v->local_zones, &lz_cfg);
++ }
+ }
+ do_data_add(ssl, v->local_zones, arg2);
+ lock_rw_unlock(&v->lock);
+@@ -1659,6 +1667,14 @@ do_view_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker,
+ ssl_printf(ssl,"error out of memory\n");
+ return;
+ }
++ if(!v->isfirst) {
++ /* Global local-zone is not used for this view,
++ * therefore add defaults to this view-specific
++ * local-zone. */
++ struct config_file lz_cfg;
++ memset(&lz_cfg, 0, sizeof(lz_cfg));
++ local_zone_enter_defaults(v->local_zones, &lz_cfg);
++ }
+ }
+ /* put the view name in the command buf */
+ (void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg);
@@ -36,6 +36,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-50252.patch \
file://CVE-2026-52863.patch \
file://CVE-2026-54478.patch \
+ file://CVE-2026-55708.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"