CVE-2026-93010
Awaiting Analysis Awaiting Analysis - Queue

DHCP Leasequery Information Disclosure in dnsmasq

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: redhat-SADP

Description
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-93010
EUVD
EUVD-2026-112825

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in dnsmasq where DHCP leasequery is enabled without restricting source addresses. A local network host can query DHCP lease records and obtain sensitive information like assigned IP addresses, MAC addresses, hostnames, and lease details without authentication.

Detection Guidance

To detect this vulnerability, check if DHCP leasequery is enabled in dnsmasq without source address restrictions. Inspect dnsmasq configuration files for leasequery-related settings. Monitor network traffic for unauthorized DHCP lease requests using tools like tcpdump or Wireshark to capture DHCP packets.

Impact Analysis

An attacker on the same network could gather details about devices and their network assignments. This information could be used for further attacks like spoofing, man-in-the-middle, or reconnaissance to identify targets for exploitation.

Mitigation Strategies

Disable DHCP leasequery if not needed. If required, restrict allowed source addresses by configuring allowed-clients or similar options in dnsmasq. Update dnsmasq to the latest version if a patch is available. Monitor network traffic for suspicious DHCP lease requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart