PowerDNS Recursor CVE-2026-52690

The attacker must be in a network position to inject or race-spoof DNS UDP replies toward the PowerDNS Recursor, spoofing the source IP of a legitimate authoritative server - this is a non-default capability requiring either on-path access, a compromised intermediate device, or exploitation of a lack of BCP38 anti-spoofing enforcement. The Recursor must be actively querying the targeted authoritative server at the time of the attack (i.e., the server's zones must be in active use). No authentication to the Recursor is required (PR:N). No user interaction is required (UI:N). Exploitation is limited by the High attack complexity (AC:H): the attacker must win a timing race or hold network position, and standard anti-spoofing controls (BCP38, source address validation) would block off-path spoofing. The vulnerability does not require any non-default configuration of the Recursor itself.

The CVSS 3.1 base score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is broadly consistent with the described attack. The High attack complexity (AC:H) reflects the genuine difficulty of spoofing DNS replies directed at a recursive resolver - the attacker must win a race or hold a network position enabling them to inject forged packets before the legitimate authoritative response arrives, a non-trivial bar. The availability impact (A:H) is appropriate because DNSSEC validation failure for an authoritative server renders DNSSEC-signed zones unresolvable through the affected Recursor. Confidentiality and integrity are rated N in the NVD vector, though the 'Information Disclosure' tag warrants caution: if the Recursor silently falls back to non-validated answers after DNSSEC failure, an integrity impact could emerge in practice; this is not confirmed by available data. EPSS score is not provided in the source data - exploitation probability cannot be quantified from available signals. No KEV listing and no known POC reduce urgency. The real-world priority is moderate-to-elevated specifically for operators who rely on DNSSEC validation for security (e.g., resolvers enforcing DNSSEC for banking, healthcare, or government domains), where validation failures have direct security consequences beyond mere availability disruption.

An attacker with the ability to inject or spoof DNS packets on the network path between the PowerDNS Recursor and a targeted authoritative server sends a forged DNS reply that mimics the authoritative server's IP but signals absence of EDNS support. The Recursor updates its internal state to mark that server as EDNS-incapable, disabling DNSSEC validation for all zones hosted on it. Downstream clients relying on the Recursor for DNSSEC-validated resolution then receive either validation failures or, potentially, unvalidated responses for those zones until the state is flushed.