CVE-2026-0397 in PowerDNS DNSdist
摘要 (英语)
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
预定
2025-11-28
披露
2026-03-31
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354353 | PowerDNS DNSdist 权限提升 | 942 | 未定义 | 官方修复 | CVE-2026-0397 |