{"id":"CVE-2026-93006","kind":"vulnerability","aliases":["CVE-2026-93006"],"related":[],"title":"dnsmasq: stale TFTP cache can serve wrong boot files to clients","description":"A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.","summary":"dnsmasq's built-in TFTP server keeps a recently used transfer cache that is not cleared when a transfer finishes, so a later client can receive previously cached file contents instead of the file it asked for. In PXE network-boot setups an attacker on the local network may be able to substitute boot content on a victim machine.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dnsmasq","infrastructure","pxe","self-hosted","tftp"],"not_affected_if":["no-pxe-boot","tftp-disabled"],"how_to_check":"- Check whether dnsmasq serves TFTP: look for `enable-tftp` in the dnsmasq configuration (`/etc/dnsmasq.conf` or files under `/etc/dnsmasq.d/`).\n- Check the installed version with `dnsmasq --version`.","fix":null,"status":"open","published_at":"2026-10-29T13:17:15+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","triaged_at":"2026-10-29T13:25:34+00:00","updated_at":"2026-10-29T13:25:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T13:25:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"dnsmasq: stale TFTP cache can serve wrong boot files to clients","impact":"medium","summary":"dnsmasq's built-in TFTP server keeps a recently used transfer cache that is not cleared when a transfer finishes, so a later client can receive previously cached file contents instead of the file it asked for. In PXE network-boot setups an attacker on the local network may be able to substitute boot content on a victim machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dnsmasq","tftp","pxe","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker-chosen boot content is served to victim machines on the network","analyst_note":"Find the affected and fixed dnsmasq versions and any vendor advisory, since the NVD entry alone gives no version ranges or fix.","how_to_check":"- Check whether dnsmasq serves TFTP: look for `enable-tftp` in the dnsmasq configuration (`/etc/dnsmasq.conf` or files under `/etc/dnsmasq.d/`).\n- Check the installed version with `dnsmasq --version`.\n- unknown whether the sources list affected version ranges.","plain_action":"","needs_analyst":true,"not_affected_if":["tftp-disabled","no-pxe-boot"],"who_is_affected":"Only systems running dnsmasq with its TFTP server enabled are exposed, typically PXE network-boot environments that serve boot files on the local network. Hosts that do not enable TFTP in dnsmasq are not affected by this flaw. The sources do not list affected versions or a fixed release.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4127,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93006':14A,17A 'abl':77B 'ask':61B 'attack':70B,115C,151C 'attacker-chosen':150C 'boot':8A,67B,80B,145C,153C 'built':28B 'built-in':27B 'cach':4A,37B,53B,106C,134C 'caus':127C 'chosen':152C 'clear':41B 'client':11A,49B,130C 'content':55B,81B,100C,154C 'cve':12A,15A 'data':135C 'dnsmasq':1A,18B,25B,91C 'environ':146C 'file':9A,54B,59B,99C,125C,140C 'finish':45B,113C 'flaw':87C 'found':89C 'host':23B 'infrastructur':19B 'instead':56B,136C 'invalid':109C 'keep':32B 'later':48B,129C 'local':73B,118C 'machin':85B,158C 'may':75B,126C 'network':66B,74B,119C,144C 'network-boot':65B,143C 'previous':52B,133C 'pxe':20B,64B,142C 'receiv':51B,132C 'recent':34B,103C 'request':122C,139C 'self':22B 'self-host':21B 'serv':6A,96C 'server':31B,94C 'setup':68B 'stale':2A 'substitut':79B,149C 'tftp':3A,24B,30B,93C,124C 'transfer':36B,44B,105C,112C 'use':35B,104C 'victim':84B,157C 'wrong':7A,98C","nicknames":[],"mitigations":[],"who_affected":"Only systems running dnsmasq with its TFTP server enabled are exposed, typically PXE network-boot environments that serve boot files on the local network. Hosts that do not enable TFTP in dnsmasq are not affected by this flaw. The sources do not list affected versions or a fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93006","severity":null,"published_at":"2026-10-29T13:17:15+00:00","modified_at":"2026-10-29T13:17:15+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","fetched_at":"2026-10-29T13:25:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}