Missing Authorization Vulnerability in PowerDNS-Admin for Zone Templates
CVE-2026-125378

5.3MEDIUM

Key Information:

Vendor

Powerdns-admin

Status
Powerdns-admin
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125378?

PowerDNS-Admin before version 2026.11.0 contains a security flaw in the apply_records handler for the /admin/template//apply endpoint. This vulnerability allows any user with authenticated User-role privileges to alter shared zone templates. Attackers can inject unauthorized NS, MX, A, or CNAME records into the templates, affecting all zones derived from them. This issue compromises the integrity of DNS configurations, potentially leading to service disruption or data exfiltration.

Affected Version(s)

PowerDNS-Admin 0 < 2026.11.0

References

https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1941
issue-tracking
https://github.com/PowerDNS-Admin/PowerDNS-Admin
product
https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v20...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.