PowerDNS Recursor CVE-2026-85555

Exploitation targets PowerDNS Recursor versions prior to 5.3.12 (5.3.x train) and 5.4.8 (5.4.x train), specifically the resolver's out-of-band NS resolution path, where delegation/NS data obtained during recursion is accepted into cache without adequate DNSSEC validation, yielding a validation bypass and cache poisoning. The practical prerequisite is that the attacker must get the recursor to resolve a name within a zone whose authoritative responses the attacker can control or spoof (e.g. by luring a client query for an attacker-chosen domain), so the attack is not a passive single-packet exploit - it depends on inducing the specific out-of-band resolution behavior. Limiting factors: the bypass is most consequential where DNSSEC validation is relied upon as a security control, and success depends on the resolver performing the vulnerable out-of-band NS resolution for attacker-reachable zones; exact timing/configuration constraints are detailed only in the vendor advisory and are not reproduced in this input.

This is a genuine high-priority patch for DNSSEC-validating PowerDNS Recursor deployments, but the available signals are thin and must be weighed carefully. The vendor (PowerDNS/Open-Xchange) explicitly rates this one of three 'High' severity CVEs in advisory 2026-12; however, the input provides NO CVSS score or vector (listed N/A), NO EPSS probability, NO CISA KEV entry, and NO evidence of public exploit code - so all quantitative exploitation signals are missing and cannot be cross-referenced against the vendor rating. The nature of the flaw (DNSSEC validation bypass plus cache poisoning via out-of-band NS resolution) is inherently serious because it defeats the integrity guarantee DNSSEC is deployed to provide and can silently redirect every downstream client of the resolver. Offsetting that, cache-poisoning/validation-bypass attacks of this type typically require the attacker to induce the resolver to resolve an attacker-influenced delegation and to win specific resolution conditions, which raises attack complexity above a trivial unauthenticated single-packet exploit. Bottom line: treat as a real priority for patching given a trusted vendor High rating and the broad deployment of PowerDNS Recursor, but note there is currently no evidence of active exploitation or public PoC, so this is urgency driven by impact and product footprint rather than by observed in-the-wild activity.

An attacker who controls (or can influence responses from) an authoritative nameserver induces a victim's PowerDNS Recursor to perform out-of-band resolution of NS records for a target zone, and supplies crafted data that is accepted without proper DNSSEC validation. The forged records are inserted into the recursor's cache, so subsequent queries from all clients of that resolver are answered with attacker-chosen addresses, enabling redirection to malicious hosts. No public exploit code was identified at time of analysis, and full technical preconditions are described only in the vendor advisory.