PT-2026-133588
CVE-2026-119658
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾