Live › vulnerability › CVE-2026-119658
PowerDNS-Admin through 2026.08.1 lets a logged-in User-role account refresh secondary zones it is not allowed to access, by supplying a different domain field in the request body. The attacker can force zone transfers of other users' zones and infer whether those zones exist from differing responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Deployments of PowerDNS-Admin through 2026.08.1 where User-role accounts can log in and where secondary zones are managed through the web interface. An attacker needs an account already authorized for at least one zone. Installations with no User-role accounts, or that do not manage secondary zones, are less exposed.
No product ranges from the sources yet.
through 2026.08.1No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.
This page as .md · .json · in your agent: get_signal("CVE-2026-119658")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.