PowerDNS CVE-2026-33260

Upgrade to a patched version: PowerDNS Authoritative to 4.9.14 or 5.0.4 or later; Recursor to 5.2.9, 5.3.6, 5.4.1, or later as applicable; dnsdist to 1.9.13 or 2.0.4 or later. Patch releases are available directly from the PowerDNS project. If immediate patching is not feasible, disable the internal web server unless explicitly required for monitoring or API functions by commenting out or removing webserver configuration directives (typically 'webserver=yes' or 'api=yes') and restarting the affected service. If the web server must remain enabled, restrict access to the web server listening address and port (typically localhost:8081 or similar) using firewall rules or network segmentation to prevent remote access. Review your PowerDNS configuration to confirm the default state (web server disabled) and audit any intentional enablement for operational necessity. Apply patches during a maintenance window, as restarting the service is required.