---
id: "CVE-2026-119658"
kind: "vulnerability"
aliases: ["CVE-2026-119658"]
title: "PowerDNS-Admin: authenticated users can refresh zones they cannot access"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "package", "powerdns", "powerdns-admin"]
not_affected_if: ["no-secondary-zones", "no-user-role-accounts"]
published_at: "2026-10-30T15:16:49+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:33:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119658", "first_seen_at": "2026-10-30T15:31:10+00:00"}]
---

# PowerDNS-Admin: authenticated users can refresh zones they cannot access

PowerDNS-Admin through 2026.08.1 lets a logged-in User-role account refresh secondary zones it is not allowed to access, by supplying a different domain field in the request body. The attacker can force zone transfers of other users' zones and infer whether those zones exist from differing responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PowerDNS-Admin version against the affected range `through 2026.08.1`
- Review which accounts hold the User role and whether they are scoped to specific zones

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119658

## From the sources

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_