Powerdns Admin
Monthly
PowerDNS-Admin through 2026.08.1 lets an authenticated User-role account that is already authorized for one zone trigger AXFR retrievals against other users' secondary (Slave) zones, and infer whether those zones exist, by supplying a different 'domain' value in the JSON body of a POST to /domain/<authorized-zone>/update. The route authorizes the zone in the URL path, but pre-patch code then replaced the zone name with the body-supplied value before issuing the backend call, so a cross-tenant key substitution slips past the per-zone access check. Severity is moderate (CVSS 5.3 / assessed CVSS:3.1 5.3, this-month priority), the flaw is not listed in CISA KEV, and no confirmed working exploit code is referenced, although a public technical writeup of the issue and its mechanism is available.
PowerDNS-Admin through 2026.08.1 lets an authenticated User-role account that is already authorized for one zone trigger AXFR retrievals against other users' secondary (Slave) zones, and infer whether those zones exist, by supplying a different 'domain' value in the JSON body of a POST to /domain/<authorized-zone>/update. The route authorizes the zone in the URL path, but pre-patch code then replaced the zone name with the body-supplied value before issuing the backend call, so a cross-tenant key substitution slips past the per-zone access check. Severity is moderate (CVSS 5.3 / assessed CVSS:3.1 5.3, this-month priority), the flaw is not listed in CISA KEV, and no confirmed working exploit code is referenced, although a public technical writeup of the issue and its mechanism is available.