What is the CVSS score of CVE-2026-42000?

CVE-2026-42000 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42000?

Yes, a patch is available for CVE-2026-42000. Update the affected software to the latest version immediately.

PowerDNS Authoritative CVE-2026-42000

EUVD-2026-31261 MEDIUM

Command Injection (CWE-77)

2026-05-21 OX

GHSA-cmjg-f724-5qh3

Command Injection Authoritative

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 21, 2026 - 11:01 EUVD

Analysis Generated

May 21, 2026 - 10:47 vuln.today

DescriptionCVE.org

Insufficient Validation of Names During AXFR

AnalysisAI

Integrity compromise in PowerDNS Authoritative Server allows network-positioned attackers to inject unauthorized DNS records by exploiting insufficient validation of DNS names received during AXFR (zone transfer) processing. The CVSS changed-scope indicator (S:C) reflects that the high-integrity impact extends beyond the vulnerable server itself to all downstream systems consuming the corrupted zone data, enabling a form of DNS record poisoning. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) constrains exploitation to adversaries with specific network positioning or control over a zone transfer source.

Technical ContextAI

AXFR (Authoritative Full Transfer) is the DNS full zone transfer protocol defined in RFC 5936, used by secondary authoritative name servers to replicate complete zone data from a primary. PowerDNS Authoritative (CPE: cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*) is a widely deployed open-source authoritative DNS server. The vulnerability arises from insufficient validation of DNS name records during AXFR ingestion - when a secondary instance processes zone transfer data containing malformed or malicious names, the lack of proper validation allows those records to be accepted, stored, and subsequently served to DNS clients. No CWE classification was provided, which limits precise root-cause characterization, but the behavior is consistent with input validation failures (broadly analogous to CWE-20). The changed-scope CVSS vector confirms the integrity impact propagates to components beyond the vulnerable server, specifically the DNS resolution experience of clients relying on the affected zone.

RemediationAI

Patch available per vendor advisory - consult the PowerDNS security advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html for the exact fixed version, which was not independently confirmed from the provided data. As a compensating control pending upgrade, restrict zone transfer sources using PowerDNS's 'allow-axfr-ips' configuration directive to permit AXFR only from explicitly enumerated trusted primary IP addresses, reducing the attacker surface by limiting who can deliver zone transfer data to the server; note that IP-based restrictions alone remain vulnerable to source address spoofing on networks without BCP38 enforcement. Additionally, deploy TSIG (Transaction Signature, RFC 2845) authentication on all zone transfer channels, which provides cryptographic verification of the AXFR source and prevents injection from unauthorized or spoofed primaries; this requires coordinated symmetric key management across all DNS peering relationships and introduces operational overhead if keys must be rotated. Deployments functioning solely as primary servers and never receiving AXFR data are not exposed to this specific vulnerability path.