Cors Misconfiguration CVE-2026-0397

This vulnerability presents a low-to-moderate real-world risk profile. The CVSS score of 3.1 (Low) reflects the combination of factors: network-based attack vector (AV:N) but high attack complexity (AC:H) due to requiring successful social engineering, no privileges needed (PR:N), and mandatory user interaction (UI:R). The impact is strictly confidentiality loss (C:L) with no integrity or availability impact (I:N/A:N). The exploitation barriers are significant-the attacker must craft a convincing phishing/social engineering attack, the target must be an authenticated administrator, the internal webserver must be explicitly enabled (non-default configuration), and the victim must actively visit the malicious site. No public exploit code or CISA KEV status is indicated in the provided data. While CORS misconfigurations are a known attack class, the requirement for user interaction and non-default configuration substantially limits exploitability. Organizations with the webserver disabled (default) face zero risk; those with it enabled should prioritize patching but can mitigate through network isolation and administrator security awareness.

An attacker creates a convincing phishing email or advertisement directing a PowerDNS administrator to a malicious website (e.g., masquerading as a dnsdist documentation or support page). When the administrator visits the malicious site while already authenticated to their local dnsdist dashboard, the attacker's JavaScript code silently issues cross-origin requests to the dnsdist API endpoint, extracting sensitive configuration information (backend server addresses, health check thresholds, traffic policies, etc.) that are normally visible only in the dashboard. The misconfigured CORS policy permits these requests, allowing the attacker to gather intelligence on the victim's DNS infrastructure without directly compromising authentication credentials. No public exploit code is identified at time of analysis.