CVE-2026-93010— Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

Quick assessment

Affected

Red Hat Red Hat Ceph Storage 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 dnsmasq 中发现了一个漏洞。当启用 DHCP leasequery 功能但未配置允许的来源地址列表时，服务器不会验证查询的发送者。本地网络中的任意主机均可请求 DHCP 租约记录，从而获取已分配的 IP 地址、MAC 地址、主机名及相关租约元数据。该功能默认处于关闭状态，仅由管理员手动开启后才会启用。

CVSS 4.3 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1087 · Account Discovery T1047 · Windows Management Instrumentation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ceph Storage 9	-	`cpe:/a:redhat:ceph_storage:9`
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenStack Platform 13 (Queens)	-	`cpe:/a:redhat:openstack:13`
Red Hat	Red Hat OpenStack Platform 18.0	-	`cpe:/a:redhat:openstack:18.0`

II. Public POCs for CVE-2026-93010

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93010

请登录查看更多情报信息。

Other References for CVE-2026-93010 (2)

https://access.redhat.com/security/cve/CVE-2026-93010 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536081 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-93010

Same Patch Batch · Red Hat · 2026-10-29 · 16 CVEs total

CVE-2026-114488	7.4 HIGH	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564	7.4 HIGH	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-118425	6.8 MEDIUM	Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolut
CVE-2026-93006	6.8 MEDIUM	Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file conten
CVE-2026-93008	6.8 MEDIUM	Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns config
CVE-2026-117548	6.5 MEDIUM	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-19610	6.5 MEDIUM	Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p
CVE-2026-117859	5.4 MEDIUM	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117627	5.4 MEDIUM	Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l
CVE-2026-93007	5.3 MEDIUM	Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011	5.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire trans
CVE-2026-117688	5.3 MEDIUM	Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-93009	4.3 MEDIUM	Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
CVE-2026-118030	4.2 MEDIUM	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr
CVE-2026-85498	3.5 LOW	Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

IV. Related Vulnerabilities

Same product: Red Hat Ceph Storage 9

Same vendor: Red Hat

Same weakness: CWE-862