CVE-2026-125378: PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint

Q: Which accounts can exploit this issue?

Any authenticated account with the User role can exploit it. Administrator privileges are not required.

Q: What must an attacker be able to access?

The attacker needs an authenticated PowerDNS-Admin session and access to the template apply endpoint at /admin/template/<template>/apply. No user interaction is required.

Published Nov 9, 2026

Updated

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the applyrecords handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.

Affected Software

1 affected component

PowerDNS PowerDNS-Admin<2026.11.0

Event History

Nov 9, 2026

CVE Published

via MITRE·11:27 PM

Data Sourced

via MITRE·11:27 PM

DescriptionSeverityWeakness

Nov 10, 2026

Data Sourced

via NVD·12:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which accounts can exploit this issue?

Any authenticated account with the User role can exploit it. Administrator privileges are not required.

What must an attacker be able to access?

The attacker needs an authenticated PowerDNS-Admin session and access to the template apply endpoint at /admin/template/<template>/apply. No user interaction is required.

What is the practical impact on DNS zones?

An attacker can replace a shared template's record set by name with attacker-chosen NS, MX, A, or CNAME records. The altered records affect every zone created from that template afterward.

Which versions are affected?

PowerDNS-Admin versions before 2026.11.0 are affected.