CVE-2026-125378— PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint

Quick assessment

Affected

PowerDNS-Admin PowerDNS-Admin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PowerDNS-Admin 在 2026.11.0 之前的版本中，其路径下的处理程序存在授权缺失漏洞。该漏洞允许任何拥有“用户（User）”角色的已认证账户修改共享区域模板。攻击者可通过名称替换模板中的记录集，将攻击者指定的 NS、MX、A 或 CNAME 记录注入到后续由该模板创建的每一个区域中。

CVSS 4.3 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1562.001 T1070.004 · File Deletion

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.

Source: CVE Program / CVE List V5