---
id: "CVE-2026-93008"
kind: "vulnerability"
aliases: ["CVE-2026-93008"]
title: "dnsmasq: CNAME handling lets upstream poison cache for unrelated names"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["dns", "dnsmasq", "runtime", "self-hosted", "split-dns"]
not_affected_if: ["no-split-dns", "single-upstream-resolver"]
published_at: "2026-10-29T13:17:16+00:00"
first_seen_at: "2026-10-29T13:25:08+00:00"
updated_at: "2026-10-29T13:25:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93008", "first_seen_at": "2026-10-29T13:25:08+00:00"}]
---

# dnsmasq: CNAME handling lets upstream poison cache for unrelated names

dnsmasq caches records for CNAME targets without checking they belong to the upstream server's authorized zone. An attacker who controls an upstream resolver in a split-DNS setup can plant cache entries for unrelated names, so later clients may receive attacker-chosen addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `dnsmasq --version` and compare it to the fixed versions below.
- Look for split-DNS rules in the dnsmasq configuration (`server=/domain/upstream` lines) that forward some domains to a specific upstream.

## Timeline

- 2026-10-29T13:25:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93008

## From the sources

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_