Live › vulnerability › CVE-2026-93008
dnsmasq caches records for CNAME targets without checking they belong to the upstream server's authorized zone. An attacker who controls an upstream resolver in a split-DNS setup can plant cache entries for unrelated names, so later clients may receive attacker-chosen addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Exposure requires a split-DNS deployment where some domains are forwarded to a specific upstream resolver that an attacker could control or influence. Systems that forward all queries to a single trusted resolver are less exposed. The sources do not name the affected versions.
No product ranges from the sources yet.
dnsmasq --version and compare it to the fixed versions below.server=/domain/upstream lines) that forward some domains to a specific upstream.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.
This page as .md · .json · in your agent: get_signal("CVE-2026-93008")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.