SZB-b1d8d18d94
EUVD-2026-114074 reports authorization bypass in PowerDNS-Admin through 2026.08.1
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- PowerDNS-Admin
- Product
- PowerDNS-Admin
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114074 describes an authorization bypass in PowerDNS-Admin through 2026.08.1, scored 5.3/10 (CVSS v3.1). Per the listing, authenticated User-role accounts can refresh secondary zones they cannot access.
If you use PowerDNS-Admin
Check PowerDNS-Admin release notes for a fixed version and upgrade
Limit User-role accounts to the zones they need until patched
What the sources say 1
· Mastodon: “PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body.” Source