CVE-2026-93010: Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
Other sources
A missing authorization check was found in dnsmasq's DHCPLEASEQUERY handler (src/rfc2131.c). When --leasequery is specified without an address argument, option parsing (src/option.c) sets OPTLEASEQUERY but leaves daemon->leasequeryaddr NULL. The source-address ACL is gated on leasequeryaddr being non-NULL, so the check is skipped and any LAN host can send DHCPLEASEQUERY and receive lease records (IP, MAC, hostname, client ID, vendor class, relay agent ID).
The feature is off by default. The man page documents the address argument as optional. This is closer to a hardening gap than a default-config vulnerability. Red Hat default package configurations do not enable --leasequery.
Affected versions: v2.92 onwards. Feature not present in v2.91 and earlier. Fix: Not yet available (reporter coordinating with upstream). Reporter: Shubham Raj (Causal Security) PSIRT Ticket: PSIRTSUPT-23743
— Red Hat
Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not enable the DHCPLEASEQUERY feature unless it is required; remove or disable the --leasequery configuration.
dnsmasq --leasequery = disabled - Configuration
If DHCP leasequery is required, specify allowed source addresses with --leasequery instead of enabling it without an address argument, so the source-address ACL is applied.
dnsmasq --leasequery address argument = configured with allowed source addresses
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed only if DHCP leasequery has been enabled with --leasequery and no allowed source address argument. The feature is off by default, and Red Hat default package configurations do not enable it.
What does an attacker need to exploit this?
An attacker needs to be a host on the local network that can send DHCPLEASEQUERY requests. No privileges or user interaction are required.
What information can an unauthorized requester obtain?
They can retrieve DHCP lease records, including assigned IP addresses, MAC addresses, hostnames, client IDs, vendor classes, relay agent IDs, and related lease metadata.
What can be done before a fix is available?
Do not enable --leasequery without an allowed source address argument. If leasequery is required, configure the source-address restriction rather than leaving the argument unspecified.
Which versions are affected?
The issue affects dnsmasq v2.92 onwards. The leasequery feature is not present in v2.91 and earlier, and a fix was not yet available in the provided information.