PowerDNS Authoritative CVE-2026-42396

Exploitation requires the target PowerDNS Authoritative instance to be actively configured for catalog zone operation (RFC 9432 support must be enabled and in use - deployments not using catalog zones are unaffected). The attacker must hold high administrative privileges (PR:H per CVSS:3.1/AV:N/AC:L/PR:H) sufficient to modify catalog zone member data, either directly or via a compromised account with DNS zone write access. Exploitation is explicitly limited by the PR:H requirement - unauthenticated or low-privileged network attackers cannot trigger this vulnerability. The failure condition is also scoped to catalog zone transfer operations only, meaning zone resolution and other DNS functions remain unaffected.

The CVSS score of 4.9 (Medium) appropriately reflects the constrained threat model: while the attack vector is Network (AV:N) and complexity is Low (AC:L), exploitation requires High Privileges (PR:H), meaning only an attacker who already holds administrative DNS zone management credentials can trigger the fault. The High availability impact (A:H) indicates that a successful attack fully disrupts catalog zone transfers, halting automated zone provisioning to secondaries. No EPSS score was provided, leaving quantitative exploitation probability uncharacterized. The absence of a CISA KEV entry and no reported POC code further suggests this is not currently under active or opportunistic exploitation. The 'Information Disclosure' tag conflicts with C:N in the CVSS vector - this inconsistency is explicitly unresolved and should be confirmed via the vendor advisory before assuming confidentiality exposure. Real-world priority is moderate-to-low for most organizations; the primary concern is insider threat or compromised privileged accounts in DNS-heavy environments relying on catalog zone automation.

An attacker who has obtained high-privileged DNS administrative access - through credential compromise, insider action, or lateral movement - crafts malformed member zone entries and introduces them into a catalog zone served by a PowerDNS Authoritative primary. When secondary nameservers attempt a catalog zone transfer, the insufficient validation causes the transfer to fail, halting automated zone updates to all secondaries dependent on that catalog. No public POC code has been identified at time of analysis.