PowerDNS Authoritative CVE-2026-41999

Two non-default PowerDNS Authoritative features must be simultaneously active: the Views feature must be configured to serve split-horizon DNS (defining distinct zone data for different client IP ranges), AND TCP PROXY protocol support must be explicitly enabled - typically present only when the server is deployed behind HAProxy, an AWS NLB, or similar load balancers that inject PROXY headers. The CVSS AC:H rating directly encodes these co-requisite conditions. Additionally, for spoofed IP exploitation to succeed, PROXY protocol headers may need to be accepted from arbitrary TCP sources rather than from a restricted set of trusted proxy IPs. Exploitation is constrained to network-accessible deployments (AV:N); no authentication is required (PR:N); no user interaction is needed (UI:N). Scope is unchanged (S:U), meaning a successful exploit does not allow lateral movement to other systems. Deployments not using Views, not using TCP PROXY protocol, or restricting PROXY header acceptance to trusted upstream IPs are not exposed.

The CVSS 4.8 score with vector AC:H correctly signals that this is a constrained, context-specific vulnerability rather than a broadly weaponizable flaw. High attack complexity (AC:H) captures the requirement that two non-default features - Views and TCP PROXY support - must both be active simultaneously, which significantly narrows the affected population. PR:N and UI:N confirm no authentication or user interaction is needed, meaning if the conditions are met, exploitation is fully remote and passive. Confidentiality and integrity impacts are rated Low (C:L/I:L), consistent with the Information Disclosure tag and the realistic scope of receiving wrong DNS view data. No EPSS score was provided in available intelligence, preventing probabilistic exploitation likelihood assessment - this gap should be noted. No KEV listing and no POC code identified at time of analysis; real-world exploitation has not been confirmed. For organizations specifically running split-horizon DNS with load-balanced PROXY protocol traffic, the practical risk is disproportionately higher than the raw score suggests, as leaking internal DNS records can enable reconnaissance or facilitate further attacks. For all others, risk is negligible.

An attacker with TCP network access to a PowerDNS Authoritative Server configured with both Views and TCP PROXY protocol support sends a connection prefaced with a crafted PROXY protocol header containing a spoofed source IP belonging to a privileged internal network segment. The server incorrectly applies the Views policy using that spoofed IP, returning DNS records from the internal view - potentially exposing internal hostnames, service endpoints, or private infrastructure details. No POC code has been identified at time of analysis, though the attack concept is mechanically straightforward for any attacker already capable of reaching the DNS server's TCP listener.