PowerDNS Recursor CVE-2026-42389

Exploitation requires PowerDNS Recursor running on the 5.4.x branch. The attacker must be positioned to deliver crafted DNS responses - specifically by controlling a legitimate authoritative DNS server whose zone is queried by the target recursor, or by intercepting or spoofing UDP DNS traffic between the recursor and authoritative servers (e.g., via BGP hijack, on-path network position, or authoritative server compromise). DNSSEC-validating deployments querying DNSSEC-signed zones are partially or fully resistant depending on whether the attack targets signed records. The CVSS PR:N metric confirms no authentication to the recursor itself is required; however, the realistic attacker prerequisite is control of or proximity to DNS authoritative infrastructure, not merely network reachability to the recursor. Deployments restricted to DNSSEC-signed zones or locked-down upstream resolver paths face substantially reduced practical risk.

The NVD CVSS score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) characterizes this as a network-accessible, low-complexity integrity issue. However, AC:L may understate real-world difficulty: exploiting this class of DNS validation flaw requires the attacker to either operate or have compromised a legitimate authoritative DNS server being queried by the target recursor, or to successfully spoof or intercept UDP DNS responses in transit - neither of which is trivially achieved at scale. No EPSS score was supplied in the available data, preventing quantitative exploitation probability assessment. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept code has been identified, indicating it is not currently an opportunistic threat. The 'Information Disclosure' tag conflicts with C:N in the CVSS vector; this discrepancy should be clarified against the full advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html. Overall real-world risk is moderate: PowerDNS Recursor is broadly deployed across ISP and enterprise infrastructure, but exploitation is practically constrained to network-privileged adversaries.

An attacker who operates or has compromised an authoritative DNS server for a domain queried by a vulnerable PowerDNS Recursor 5.4.x instance sends a crafted DNS response that bypasses the recursor's insufficient answer validation. The recursor accepts and caches the manipulated record, causing downstream clients to receive false DNS resolutions that could redirect them to attacker-controlled infrastructure. No public proof-of-concept code has been identified, and this scenario is practically constrained to attackers with a privileged position in the DNS resolution path.