CVE-2026-24029: DNS over HTTPS ACL bypass
When the earlyacldrop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the early_acl_drop/earlyACLDrop option is enabled on the DNS over HTTPS frontend so the ACL check is not skipped and clients are restricted according to the configured ACL.
DNS over HTTPS frontend (nghttp2 provider) early_acl_drop (earlyACLDrop in Lua) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24029?
CVE-2026-24029 is considered a medium severity vulnerability due to its potential impact on access control features.
How do I fix CVE-2026-24029?
To fix CVE-2026-24029, enable the early_acl_drop option in the configuration of PowerDNS dnsdist.
What specific vulnerability does CVE-2026-24029 address?
CVE-2026-24029 addresses an ACL bypass issue in DNS over HTTPS when the early ACL drop option is disabled.
Which software is affected by CVE-2026-24029?
CVE-2026-24029 affects PowerDNS dnsdist when the specific configuration option is not set.
Can CVE-2026-24029 lead to unauthorized access?
Yes, CVE-2026-24029 can lead to unauthorized access as it allows clients to bypass ACL checks for DoH queries.