{"id":"CVE-2026-119658","kind":"vulnerability","aliases":["CVE-2026-119658"],"related":[],"title":"PowerDNS-Admin: authenticated users can refresh zones they cannot access","description":"PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.","summary":"PowerDNS-Admin through 2026.08.1 lets a logged-in User-role account refresh secondary zones it is not allowed to access, by supplying a different domain field in the request body. The attacker can force zone transfers of other users' zones and infer whether those zones exist from differing responses.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","package","powerdns","powerdns-admin"],"not_affected_if":["no-secondary-zones","no-user-role-accounts"],"how_to_check":"- Check the installed PowerDNS-Admin version against the affected range `through 2026.08.1`\n- Review which accounts hold the User role and whether they are scoped to specific zones","fix":null,"status":"open","published_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:40+00:00","updated_at":"2026-10-30T15:33:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T15:33:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PowerDNS-Admin: authenticated users can refresh zones they cannot access","impact":"low","summary":"PowerDNS-Admin through 2026.08.1 lets a logged-in User-role account refresh secondary zones it is not allowed to access, by supplying a different domain field in the request body. The attacker can force zone transfers of other users' zones and infer whether those zones exist from differing responses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["powerdns-admin","powerdns","dns"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users read zone existence and force transfers of other zones","analyst_note":"Confirm the fixed version and whether the flaw is reachable by default; only the NVD entry was given.","how_to_check":"- Check the installed PowerDNS-Admin version against the affected range `through 2026.08.1`\n- Review which accounts hold the User role and whether they are scoped to specific zones\n- unknown for further checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-user-role-accounts","no-secondary-zones"],"who_is_affected":"Deployments of PowerDNS-Admin through 2026.08.1 where User-role accounts can log in and where secondary zones are managed through the web interface. An attacker needs an account already authorized for at least one zone. Installations with no User-role accounts, or that do not manage secondary zones, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4158,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119658':14A,17A '-2026':13A,16A '2026.08.1':28B,80C 'access':11A,46B,99C 'account':37B,92C 'admin':3A,23B,26B,78C 'allow':44B,87C 'attack':58B,110C 'authent':4A,88C 'author':83C,111C 'axfr':119C 'axfr-retriev':118C 'bodi':56B,109C 'bypass':84C 'cannot':10A,98C 'contain':81C 'cve':12A,15A 'differ':50B,74B,103C,132C 'dns':18B 'domain':51B,104C 'exist':72B,130C 'field':52B,105C 'forc':60B,117C 'infer':68B,128C 'json':108C 'let':29B 'log':32B 'logged-in':31B 'one':114C 'packag':19B 'powerdn':2A,20B,22B,25B,77C 'powerdns-admin':1A,21B,24B,76C 'refresh':7A,38B,94C 'request':55B 'respons':75B,133C 'retriev':120C 'role':36B,91C 'secondari':39B,95C,125C 'suppli':48B,101C 'transfer':62B,121C 'user':5A,35B,65B,90C,124C 'user-rol':34B,89C 'vulner':85C 'whether':69B 'zone':8A,40B,61B,66B,71B,96C,115C,126C,129C","nicknames":[],"mitigations":[],"who_affected":"Deployments of PowerDNS-Admin through 2026.08.1 where User-role accounts can log in and where secondary zones are managed through the web interface. An attacker needs an account already authorized for at least one zone. Installations with no User-role accounts, or that do not manage secondary zones, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119658","severity":null,"published_at":"2026-10-30T15:16:49+00:00","modified_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}