Description
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PowerDNS-Admin PowerDNS-Admin
Default version status: unaffected
0 to ≤ 2026.08.1affected
References
- https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1940 ↗
- https://github.com/PowerDNS-Admin/PowerDNS-Admin/pull/1942 ↗
- https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/domain.py#L738-L766 ↗
- https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/models/domain.py#L702-L730 ↗
- https://hackmd.io/@hieuPenguinnn/powerdns-admin-record-update-body-domain-override-cross-zone-idor ↗
- https://github.com/PowerDNS-Admin/PowerDNS-Admin ↗
- https://www.vulncheck.com/advisories/powerdns-admin-through-2026.08.1-authorization-bypass-via-domain-domain-name-update ↗