---
id: "CVE-2026-93006"
kind: "vulnerability"
aliases: ["CVE-2026-93006"]
title: "dnsmasq: stale TFTP cache can serve wrong boot files to clients"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dnsmasq", "infrastructure", "pxe", "self-hosted", "tftp"]
not_affected_if: ["no-pxe-boot", "tftp-disabled"]
published_at: "2026-10-29T13:17:15+00:00"
first_seen_at: "2026-10-29T13:25:08+00:00"
updated_at: "2026-10-29T13:25:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93006", "first_seen_at": "2026-10-29T13:25:08+00:00"}]
---

# dnsmasq: stale TFTP cache can serve wrong boot files to clients

dnsmasq's built-in TFTP server keeps a recently used transfer cache that is not cleared when a transfer finishes, so a later client can receive previously cached file contents instead of the file it asked for. In PXE network-boot setups an attacker on the local network may be able to substitute boot content on a victim machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether dnsmasq serves TFTP: look for `enable-tftp` in the dnsmasq configuration (`/etc/dnsmasq.conf` or files under `/etc/dnsmasq.d/`).
- Check the installed version with `dnsmasq --version`.

## Timeline

- 2026-10-29T13:25:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93006

## From the sources

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_