CVE-2026-125378 · Package
NO FIX YET · SEE WHAT TO DO
PowerDNS-Admin lets any authenticated User-role account replace the record set of a shared zone template through the apply_records handler. Records injected this way (NS, MX, A or CNAME) end up in every zone later created from that template.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run PowerDNS-Admin with multiple user accounts and shared zone templates are exposed. Any User-role account can modify those templates, so instances with only admin accounts or no shared templates carry less risk.
Not affected if no-shared-templates, single-user-instance
Who cares dns, powerdns-admin, self-hosted
2026.11.02026.11.0 or laterPowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.