Dnsdist CVE-2026-0396

The CVSS score of 3.1 reflects a low-severity vulnerability with network attack vector, high complexity (AC:H), no privilege requirement (PR:N), but critically, requires user interaction (UI:R) and results only in low integrity impact (I:L) with no confidentiality or availability damage. The high complexity and required user interaction significantly constrain real-world exploitability-an attacker must craft specific DNS queries and convince a dashboard user to interact with the injected content, making this substantially lower risk than the score alone suggests. No EPSS score or KEV status was provided, and no public exploit code availability was confirmed. From an SSVC perspective, this is non-critical: the automatable exploitation is constrained by the UI requirement, technical impact is limited to integrity of the dashboard display, and practical impact requires both malicious DNS traffic and user action. This is a case of moderate CVSS masking lower real-world priority due to exploitation constraints.

An attacker sends a series of crafted DNS queries containing HTML/JavaScript payloads to a DNSdist instance with dynamic suffix-match rules enabled. The injected content is stored in the rule evaluation logic and reflected in the internal web dashboard. When a DNSdist administrator or operator accesses the dashboard to review statistics or rule activity, the malicious HTML renders, potentially stealing session cookies, capturing credentials, or performing unauthorized actions within the dashboard. The high attack complexity and required user interaction mean this is not a trivial exploit-the attacker must understand the target's rule configuration and successfully trigger dashboard interaction.