CVE-2026-119658— PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

Quick assessment

Affected

PowerDNS-Admin PowerDNS-Admin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PowerDNS-Admin 在 2026.08.1 及之前的版本中存在一个授权绕过漏洞。该漏洞允许已认证的“用户角色（User-role）”账户通过在 JSON 请求体中提供不同的字段，来刷新其无权访问的从属区域（secondary zones）。攻击者若拥有任意一个区域的授权，即可强制发起针对其他用户从属区域的 AXFR 检索传输（axfr-retrieve），并通过分析不同的响应结果推断这些区域是否存在。

CVSS 4.3 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

Source: CVE Program / CVE List V5

Vulnerability Description

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PowerDNS-Admin	PowerDNS-Admin	0 ~ 2026.08.1	-

II. Public POCs for CVE-2026-119658

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119658

请登录查看更多情报信息。

Other References for CVE-2026-119658 (7)

https://github.com/PowerDNS-Admin/PowerDNS-Admin product
https://github.com/PowerDNS-Admin/PowerDNS-Admin/pull/1942 issue-tracking patch
https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1940 issue-tracking
https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/domain.py#L738-L766 technical-description
https://hackmd.io/@hieuPenguinnn/powerdns-admin-record-update-body-domain-override-cross-zone-idor third-party-advisory
https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/models/domain.py#L702-L730 technical-description
https://www.vulncheck.com/advisories/powerdns-admin-through-2026.08.1-authorization-bypass-via-domain-domain-name-update third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119658

IV. Related Vulnerabilities

Same weakness: CWE-639