PowerDNS Authoritative CVE-2026-33609

Exploitation requires three specific conditions: First, the target PowerDNS Authoritative instance must be configured with LDAP as an active backend storage mechanism (not file-based or SQL storage). Second, the 8bit-dns feature must be explicitly enabled in the PowerDNS configuration, allowing non-ASCII characters in DNS queries that trigger the vulnerable code path. Third, the attacker must possess valid authentication credentials to query the PowerDNS service-public/unauthenticated access is insufficient. The vulnerability does not affect default installations using standard DNS storage backends without LDAP integration. Exploitation is further limited by the need for detailed knowledge of the target's LDAP directory structure and query syntax, making it a selective attack rather than a universal vulnerability in all PowerDNS deployments.

CVSS 5.3 with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N indicates the vulnerability requires network access but high complexity, authenticated user privileges, and impacts only confidentiality within the user's own session scope. The high complexity requirement (AC:H) and authentication prerequisite (PR:L) significantly limit real-world exploitation compared to the disclosed confidentiality impact. The vulnerability is information disclosure only-no integrity or availability impact-making it suitable for targeted reconnaissance rather than mass exploitation. Without EPSS score or KEV status in the provided data, risk assessment relies on CVSS signals: the combination of authentication requirement and AC:H suggests this is opportunistic exploitation by compromised or insider accounts rather than a vector for broad compromise. The attack requires deep knowledge of LDAP syntax and target directory structure, further limiting the attacker pool. Moderate priority for organizations using LDAP backends with 8bit-dns enabled; lower priority for other deployments.

An authenticated user (or attacker with valid PowerDNS credentials) sends a specially crafted DNS query containing LDAP filter metacharacters (e.g., wildcards or boolean operators) to the PowerDNS server configured with LDAP backend and 8bit-dns enabled. The server does not properly escape these characters before constructing the LDAP query, allowing the attacker to modify the query logic to enumerate arbitrary domain subtrees and retrieve sensitive DNS records that should be restricted to their privilege level. For example, injecting '*' or '(|(uid=*))' syntax into the query could bypass domain scope restrictions and expose subordinate DNS zones.