PowerDNS Recursor CVE-2026-52686

Exploitation requires two concurrent conditions: first, the attacker must have a network position enabling injection of forged DNS responses - either a man-in-the-middle position on the link between the recursor and authoritative nameservers, or the ability to perform DNS spoofing/cache poisoning. Second, the DNS query being processed must produce a wildcard-synthesized answer that is specifically a CNAME or DNAME record type; wildcard answers of other types (A, AAAA, MX, TXT, etc.) are not affected. The recursor does not need to be misconfigured - the flaw exists in the standard DNSSEC validation code path when both conditions coincide. Exploitation is limited by: the requirement for network-level access to inject responses (not purely remote over the open internet without that position), the statistical rarity of wildcard CNAME/DNAME patterns in DNSSEC-signed zones, and the high attack complexity reflected in CVSS AC:H.

The official CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the constrained real-world risk. Attack complexity is genuinely high: exploitation requires an adversary to be positioned to inject or spoof DNS responses in transit - either as a network man-in-the-middle or via DNS cache poisoning - and additionally requires the target query to match a wildcard that returns a CNAME or DNAME record, a less common configuration. The integrity impact is rated Low (I:L), reflecting that a successful bypass allows an attacker to have forged NSEC/NSEC3 records accepted, but the direct CVSS scope does not extend to the downstream clients who may be redirected. EPSS data was not provided, making probabilistic exploitation likelihood indeterminate. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. Despite the low CVSS score, DNSSEC bypass is architecturally significant: it undermines the trust chain that protective DNS relies upon, and environments using DNSSEC as a control against DNS hijacking should treat this as a higher operational priority than the raw score suggests. There is no conflicting signal between the CVSS vector and the description - both indicate a network-accessible but high-complexity attack with no authentication requirement.

An attacker with a man-in-the-middle position on the network path between the PowerDNS Recursor and an upstream authoritative server crafts a forged DNS response containing an unsigned or malformed NSEC/NSEC3 record alongside a wildcard-synthesized CNAME answer. Because the recursor skips signature validation on NSEC/NSEC3 records in this code path, it accepts the forged proof, resolves the CNAME chain, and returns a DNS result to downstream clients that DNSSEC should have rejected - effectively neutralizing the integrity guarantees DNSSEC provides for that query. No public proof-of-concept code was identified at time of analysis, and the attack requires controlled network positioning plus a matching wildcard-CNAME/DNAME query pattern, limiting opportunistic exploitation.