---
id: "CVE-2026-93640"
kind: "vulnerability"
aliases: ["CVE-2026-93640"]
title: "Zimbra dnscache package: local user can read root files via sudo"
severity: "high"
cvss: 7.8
epss: 0.0014
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["email", "infrastructure", "linux", "self-hosted", "zimbra"]
not_affected_if: ["no-dnscache-package", "other-zcs-versions"]
published_at: "2026-10-23T14:17:57+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93640", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-93640", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Zimbra dnscache package: local user can read root files via sudo

The optional dnscache package in Zimbra Collaboration Suite lets the unix zimbra account run zmunbound with arbitrary arguments through passwordless sudo. A crafted Unbound configuration keeps root privileges and can expose root-readable files such as password hashes and private keys, or overwrite privileged configuration files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the dnscache package is installed on the Zimbra host and note the ZCS version (ZCS 10.1.16 and 10.1.21 are named as affected).
- Run `sudo -l -U zimbra` and look for passwordless entries for zmunbound.

## Fix

- Upgrade ZCS to a release that includes the fix; the sources do not name the fixed version.
- Remove the dnscache package or the sudo rule for zmunbound if it is not needed; this is an inference, not stated in the sources.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93640
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-93640

## From the sources

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_