What is the CVSS score of CVE-2026-52690?

CVE-2026-52690 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-52690?

Yes, a patch is available for CVE-2026-52690. Update the affected software to the latest version immediately.

PowerDNS Recursor CVE-2026-52690

EUVD-2026-39360 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-06-25 OX

GHSA-c2h5-7f6m-jqmp

Authentication Bypass Suse Powerdns Recursor

5.9

CVSS 3.1 · Vendor: OX

Severity by source

Vendor (OX) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network spoofing attack with no privileges; AC:H reflects DNS reply race/injection requirement; availability-only impact as DNSSEC validation failure disrupts resolution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 25, 2026 - 15:17 EUVD

Analysis Generated

Jun 25, 2026 - 14:36 vuln.today

DescriptionCVE.org

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

AnalysisAI

DNSSEC validation in PowerDNS Recursor can be silently undermined by network-positioned attackers who spoof DNS replies to trick the Recursor into permanently marking a legitimate authoritative server's IP as EDNS-incapable. Once that state is poisoned, the Recursor is unable to perform proper DNSSEC validation for any zones served by that authoritative server, effectively disabling a critical security layer for downstream clients. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack complexity is rated High due to the spoofing prerequisite.

Technical ContextAI

PowerDNS Recursor (CPE: cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*) is a recursive DNS resolver widely deployed by ISPs and enterprises. EDNS (Extension Mechanisms for DNS, RFC 6891) is a required capability for DNSSEC: it allows DNS messages larger than 512 bytes, which are needed to carry DNSSEC signatures (RRSIG) and keys (DNSKEY). When a Recursor communicates with an authoritative server, it probes for EDNS support; if the server appears not to support EDNS, the Recursor falls back to legacy DNS, losing the ability to receive and validate DNSSEC records. This vulnerability exploits that probe-and-fallback mechanism: an off-path or on-path attacker spoofs a reply to the Recursor indicating that a targeted authoritative server does not support EDNS. The Recursor then caches that (false) state, and DNSSEC validation for all zones served by that server fails for the lifetime of that cached state. The CWE is not formally assigned by NVD, but the root cause class is best described as improper state management / spoofing of protocol capability negotiation, analogous to downgrade attacks on cryptographic protocol negotiation. The 'Information Disclosure' tag in the source data is noted but appears incongruent with the CVSS impact metrics (C:N/I:N), possibly reflecting concern that DNSSEC validation failure could, in some resolver configurations, cause fallback to unvalidated answers - though the description does not explicitly confirm this behavior.

RemediationAI

The primary remediation is to apply the patch or upgrade to the fixed version of PowerDNS Recursor as specified in the vendor advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html. Exact fix versions are not independently confirmed from the available data - consult the advisory for precise version numbers. As a compensating control pending patching, operators can reduce the attack surface by deploying the Recursor behind network controls that restrict which source IPs can send DNS replies to the resolver (e.g., BCP38/BCP84 anti-spoofing filters at the network boundary, or restricting resolver-to-authoritative communication to known-good egress paths). Configuring DNSSEC validation in a mode that fails closed (rejecting queries rather than falling back to unvalidated answers) will prevent silent DNSSEC bypass if fallback behavior is possible, though this may impact availability for affected zones. Operators should also monitor for anomalous DNSSEC validation failure rates as a detection signal for active exploitation attempts.