{"id":"CVE-2026-93010","kind":"vulnerability","aliases":["CVE-2026-93010"],"related":[],"title":"dnsmasq: DHCP leasequery leaks lease records to any local host","description":"A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.","summary":"When DHCP leasequery is enabled without an allowed source list, dnsmasq does not check who sends the query. A host on the local network can read lease records including assigned addresses, MAC addresses and hostnames.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dhcp","dnsmasq","infrastructure","self-hosted"],"not_affected_if":["default-config","leasequery-disabled"],"how_to_check":"- Check whether leasequery is enabled in the dnsmasq configuration, for example with `grep -i leasequery /etc/dnsmasq.conf /etc/dnsmasq.d/*`\n- Check whether any allowed source addresses are listed alongside it\n- Check the installed version with `dnsmasq --version`","fix":null,"status":"open","published_at":"2026-10-29T14:18:00+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:16+00:00","updated_at":"2026-10-29T14:26:16+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-29T14:26:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"dnsmasq: DHCP leasequery leaks lease records to any local host","impact":"low","summary":"When DHCP leasequery is enabled without an allowed source list, dnsmasq does not check who sends the query. A host on the local network can read lease records including assigned addresses, MAC addresses and hostnames.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dnsmasq","self-hosted","dhcp"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"local hosts read DHCP lease data including MAC addresses","analyst_note":"","how_to_check":"- Check whether leasequery is enabled in the dnsmasq configuration, for example with `grep -i leasequery /etc/dnsmasq.conf /etc/dnsmasq.d/*`\n- Check whether any allowed source addresses are listed alongside it\n- Check the installed version with `dnsmasq --version`","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","leasequery-disabled"],"who_is_affected":"Only servers running dnsmasq with DHCP leasequery turned on and no list of allowed source addresses. The feature is off by default, so systems that never enabled it can skip this. Exposure is limited to hosts that can reach the DHCP service on the local network.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4111,"output_tokens":519,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93010':13A,16A 'address':53B,55B,73C,97C,99C 'administr':111C 'allow':30B,71C 'assign':52B,96C 'check':36B,78C 'cve':11A,14A 'dhcp':2A,17B,24B,65C,91C 'dnsmasq':1A,18B,33B,63C 'enabl':27B,68C 'featur':106C 'flaw':59C 'found':61C 'host':10A,22B,42B,84C 'hostnam':57B,100C 'includ':51B 'infrastructur':19B 'leak':4A 'learn':95C 'leas':5A,49B,92C,103C 'leasequeri':3A,25B,66C 'list':32B,70C 'local':9A,45B,87C 'mac':54B,98C 'metadata':104C 'network':46B,88C 'queri':40B,82C 'read':48B 'record':6A,50B,93C 'relat':102C 'request':90C 'self':21B 'self-host':20B 'send':38B 'sent':80C 'server':75C 'sourc':31B,72C 'turn':112C 'unless':109C 'without':28B,69C","nicknames":[],"mitigations":[],"who_affected":"Only servers running dnsmasq with DHCP leasequery turned on and no list of allowed source addresses. The feature is off by default, so systems that never enabled it can skip this. Exposure is limited to hosts that can reach the DHCP service on the local network.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93010","severity":null,"published_at":"2026-10-29T14:18:00+00:00","modified_at":"2026-10-29T14:18:00+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}