What is the CVSS score of CVE-2026-41999?

CVE-2026-41999 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41999?

Yes, a patch is available for CVE-2026-41999. Update the affected software to the latest version immediately.

PowerDNS Authoritative CVE-2026-41999

EUVD-2026-31262 MEDIUM

Improper Access Control (CWE-284)

2026-05-21 OX

GHSA-f6hj-gwxc-95c3

Authentication Bypass Authoritative

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 21, 2026 - 11:01 EUVD

Analysis Generated

May 21, 2026 - 10:46 vuln.today

DescriptionCVE.org

Incorrect Behaviour of Views with TCP PROXY Requests

AnalysisAI

Incorrect view selection in PowerDNS Authoritative Server when processing TCP PROXY protocol requests exposes DNS records intended for a different network segment to remote unauthenticated attackers, producing both unauthorized information disclosure and limited integrity impact. Deployments running split-horizon DNS via the Views feature alongside TCP PROXY protocol support are the specific affected population. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the attack concept requires no authentication and no user interaction, making it relevant wherever both features are co-deployed.

Technical ContextAI

PowerDNS Authoritative Server (CPE: cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*) supports a Views mechanism - a split-horizon DNS construct that returns distinct record sets to clients based on their source IP, commonly used to serve different data to internal versus external networks. The TCP PROXY protocol (originally specified by HAProxy) prepends a header to TCP streams carrying the original client IP through load balancers or reverse proxies to backend services. The vulnerability arises because the Views policy evaluation incorrectly handles the client address extracted from PROXY protocol headers, applying the wrong view for the request. No CWE was formally assigned; the behavior is closest in character to CWE-290 (Authentication Bypass by Spoofing) or CWE-284 (Improper Access Control) applied to DNS view selection logic. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N reflects that the attack is network-reachable with no credentials but requires specific co-configured conditions.

RemediationAI

Patch available per vendor advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html - the exact patched version was not included in the available intelligence and must be confirmed from that advisory before upgrading. As an immediate compensating control, disable TCP PROXY protocol support on the PowerDNS Authoritative instance if it is not operationally required; this eliminates the attack surface entirely but will cause loss of real client IP visibility through load balancers, potentially affecting Views-based access control downstream. If PROXY protocol cannot be disabled, restrict its acceptance to trusted upstream proxy IP ranges via host-based firewall or network ACL - this reduces exposure to only those trusted sources, though it does not fix the underlying logic flaw. Organizations should validate that after patching, Views correctly identifies clients behind PROXY-protocol-enabled load balancers to avoid service disruption.