DEBIAN-CVE-2026-93010: Medium severity debian/dnsmasq vulnerability
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If DHCP leasequery is enabled, configure an explicit list of allowed source addresses so the server checks who sent each query.
dnsmasq DHCP leasequery allowed source addresses = explicitly listed
Event History
Frequently Asked Questions
Which deployments are exposed?
Only dnsmasq deployments where DHCP leasequery has been explicitly enabled without an allowed-source-address list are exposed. The feature is disabled by default.
What does an attacker need to exploit this?
An attacker needs network access to the local network from which they can send DHCP leasequery requests. No privileges or user interaction are required.
What information can be disclosed?
Unauthorized queries can reveal DHCP lease records, including assigned IP addresses, MAC addresses, hostnames, and related lease metadata.
What can be done before a fix is available?
Disable DHCP leasequery if it is not required. If it must remain enabled, configure an allowed-source-address list so dnsmasq restricts which hosts may submit lease queries.