PowerDNS Authoritative CVE-2026-42005

Two non-default conditions must both be present for exploitation to be possible: (1) the internal web server must be explicitly enabled in pdns.conf (it is DISABLED BY DEFAULT, so the vast majority of deployments are not affected); and (2) the attacker must possess low-privilege authentication credentials to the API, as confirmed by the CVSS PR:L metric. Additionally, the API port (typically 8081/tcp) must be reachable from the attacker's network position. What limits exploitation: the default-disabled state of the web server is the primary barrier; secondary barriers include API key controls and network-level firewall restrictions. Deployments where the web server remains disabled, where the API port is firewalled to trusted hosts only, or where no API credentials have been issued to untrusted parties are not exploitable.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the real-world risk profile. The attack vector is network (AV:N) but the scope is unchanged (S:U) and availability impact is only Low (A:L), meaning this is a partial rather than complete service disruption. The most significant risk limiter is architectural: the vulnerable internal web server component is disabled by default, meaning the overwhelming majority of PowerDNS Authoritative deployments are not exploitable without a deliberate operator decision to enable this feature. PR:L confirms that low-privilege authentication is required - unauthenticated exploitation is not possible per the CVSS vector. EPSS data is not provided in the available intelligence, and this vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept is known. Overall, this is a genuine but low-priority finding for most organizations; priority rises only for deployments that have explicitly enabled the internal web server and exposed it to untrusted networks.

An attacker who has obtained low-privilege credentials to the PowerDNS Authoritative internal web server API - in a deployment where that API has been explicitly enabled and the port is reachable - sends a crafted HTTP request engineered to trigger repeated or unbounded memory allocation. The PowerDNS process exhausts available system memory, causing the DNS authoritative service to become unresponsive or crash, resulting in resolution failures for all hosted zones until the process is restarted.