Authorization Bypass in PowerDNS-Admin Affects User Role Accounts

CVE-2026-119658

What is CVE-2026-119658?

PowerDNS-Admin versions up to 2026.08.1 are susceptible to an authorization bypass vulnerability. This flaw permits authenticated User-role accounts to refresh secondary zones that they are not authorized to access by altering the 'domain' field in the JSON body of a request. Consequently, an attacker with authorization to any specific zone can unintentionally trigger axfr-retrieve transfers for secondary zones owned by other users, potentially exposing sensitive information and enabling inference of zone existence based on variations in response.

References