{"id":"CVE-2026-125378","kind":"vulnerability","aliases":["CVE-2026-125378"],"related":[],"title":"PowerDNS-Admin: any user can rewrite shared zone templates","description":"PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.","summary":"PowerDNS-Admin lets any authenticated User-role account replace the record set of a shared zone template through the apply_records handler. Records injected this way (NS, MX, A or CNAME) end up in every zone later created from that template.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","package","powerdns-admin","self-hosted"],"not_affected_if":["no-shared-templates","single-user-instance"],"how_to_check":"- Check the installed PowerDNS-Admin version; affected builds are those before `2026.11.0`\n- Review who holds User-role accounts and whether zone templates are shared with them","fix":"- PowerDNS-Admin: move to `2026.11.0` or later","status":"open","published_at":"2026-11-10T00:17:10+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","triaged_at":"2026-11-10T00:30:34+00:00","updated_at":"2026-11-10T00:30:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T00:30:34Z","model":"claude-haiku-5-5","output":{"fix":"- PowerDNS-Admin: move to `2026.11.0` or later","reach":"network","title":"PowerDNS-Admin: any user can rewrite shared zone templates","impact":"medium","summary":"PowerDNS-Admin lets any authenticated User-role account replace the record set of a shared zone template through the apply_records handler. Records injected this way (NS, MX, A or CNAME) end up in every zone later created from that template.","audience":"businesses","category":"package","nicknames":[],"who_cares":["powerdns-admin","dns","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker alters DNS records in zones created from shared templates","analyst_note":"Ecosystem and product details are not in the signal; the fixed version is stated in the description.","how_to_check":"- Check the installed PowerDNS-Admin version; affected builds are those before `2026.11.0`\n- Review who holds User-role accounts and whether zone templates are shared with them","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-user-instance","no-shared-templates"],"who_is_affected":"Teams that run PowerDNS-Admin with multiple user accounts and shared zone templates are exposed. Any User-role account can modify those templates, so instances with only admin accounts or no shared templates carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4627,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125378':13A,16A '-2026':12A,15A '/admin/template':84C '/apply':85C '2026.11.0':72C 'account':34B,93C 'admin':3A,21B,27B,70C 'appli':46B,80C 'attack':98C,110C 'attacker-chosen':109C 'authent':30B,89C 'author':76C 'chosen':111C 'cname':57B,116C 'contain':73C 'creat':64B,122C 'cve':11A,14A 'dns':17B 'end':58B 'everi':61B,119C 'handler':48B,82C 'host':24B 'inject':50B,108C 'later':63B,121C 'let':28B,87C 'miss':75C 'modifi':94C 'mx':54B,113C 'name':107C 'ns':53B,112C 'packag':18B 'powerdn':2A,20B,26B,69C 'powerdns-admin':1A,19B,25B,68C 'record':37B,47B,49B,81C,104C,117C 'replac':35B,100C 'rewrit':7A 'role':33B,92C 'self':23B 'self-host':22B 'set':38B,105C 'share':8A,41B,95C 'templat':10A,43B,67B,97C,102C 'user':5A,32B,91C 'user-rol':31B,90C 'vulner':77C 'way':52B 'zone':9A,42B,62B,96C,120C","nicknames":[],"mitigations":[],"who_affected":"Teams that run PowerDNS-Admin with multiple user accounts and shared zone templates are exposed. Any User-role account can modify those templates, so instances with only admin accounts or no shared templates carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","medium","package","powerdnsadmin","selfhosted"],"campaign_type":null,"search_a":"'-125378':13A,16A '-2026':12A,15A 'admin':3A 'cve':11A,14A 'powerdn':2A 'powerdns-admin':1A 'rewrit':7A 'share':8A 'templat':10A 'user':5A 'zone':9A","search_b":"'account':34B 'admin':21B,27B 'appli':46B 'authent':30B 'cname':57B 'creat':64B 'dns':17B 'end':58B 'everi':61B 'handler':48B 'host':24B 'inject':50B 'later':63B 'let':28B 'mx':54B 'ns':53B 'packag':18B 'powerdn':20B,26B 'powerdns-admin':19B,25B 'record':37B,47B,49B 'replac':35B 'role':33B 'self':23B 'self-host':22B 'set':38B 'share':41B 'templat':43B,67B 'user':32B 'user-rol':31B 'way':52B 'zone':42B,62B","search_c":"'/admin/template':84C '/apply':85C '2026.11.0':72C 'account':93C 'admin':70C 'appli':80C 'attack':98C,110C 'attacker-chosen':109C 'authent':89C 'author':76C 'chosen':111C 'cname':116C 'contain':73C 'creat':122C 'everi':119C 'handler':82C 'inject':108C 'later':121C 'let':87C 'miss':75C 'modifi':94C 'mx':113C 'name':107C 'ns':112C 'powerdn':69C 'powerdns-admin':68C 'record':81C,104C,117C 'replac':100C 'role':92C 'set':105C 'share':95C 'templat':97C,102C 'user':91C 'user-rol':90C 'vulner':77C 'zone':96C,120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125378","severity":null,"published_at":"2026-11-10T00:17:10+00:00","modified_at":"2026-11-10T00:17:10+00:00","first_seen_at":"2026-11-10T00:28:43+00:00","fetched_at":"2026-11-10T00:28:43+00:00","note":null}],"documents":[{"id":111538,"url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/commit/baa0a19730798dfac3dd6c2bdfad8616a80bc17a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111539,"url":"https://github.com/PowerDNS-Admin/PowerDNS-Admin/releases/tag/v2026.11.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111540,"url":"https://www.vulncheck.com/advisories/powerdns-admin-before-2026.11.0-missing-authorization-via-template-apply-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}