CVE-2026-0397: Information disclosure via CORS misconfiguration
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the CORS misconfiguration on the dashboard/internal webserver by restricting the CORS policy to the necessary, trusted origins and disallowing unwanted cross-origin requests; ensure the internal webserver is not exposed in a way that allows attacker-controlled sites to extract running configuration.
Internal webserver (dashboard) CORS policy / Cross-Origin Resource Sharing configuration = Do not allow cross-origin access (disable/lock down CORS to required origins only)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0397?
CVE-2026-0397 has a severity rating that indicates a significant risk of information disclosure due to CORS misconfiguration.
How do I fix CVE-2026-0397?
To fix CVE-2026-0397, disable the internal webserver feature in PowerDNS DNSDist or ensure proper CORS configurations are set.
What types of information can be disclosed due to CVE-2026-0397?
CVE-2026-0397 can lead to the disclosure of sensitive information about the running configuration from the dashboard.
Which versions of PowerDNS DNSDist are affected by CVE-2026-0397?
CVE-2026-0397 affects PowerDNS DNSDist versions between 1.9.0 and 1.9.12, and between 2.0.0 and 2.0.3.
Who is at risk from the CVE-2026-0397 vulnerability?
Administrators of PowerDNS DNSDist systems with the internal webserver enabled are at risk from CVE-2026-0397.