CVE-2026-125378
Received Received - Intake

PowerDNS-Admin Missing Authorization in Template Apply

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125378
EUVD
EUVD-2026-120541

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PowerDNS-Admin PowerDNS-Admin From 0 (inc) to 2026.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PowerDNS-Admin before 2026.11.0 has a missing authorization flaw in the apply_records handler for /admin/template/<template>/apply. Any authenticated user with a User role can modify shared zone templates by injecting attacker-chosen NS, MX, A, or CNAME records. These records are then applied to every zone created from the compromised template.

Detection Guidance

Check PowerDNS-Admin logs for unauthorized POST requests to /admin/template/<template>/apply from non-operator accounts. Review zone templates for unexpected NS, MX, A, or CNAME records. Use the API to list all template modifications and compare against authorized changes.

Impact Analysis

Attackers can redirect traffic, enable DNS hijacking, or delegate subtrees to attacker-controlled nameservers. This could lead to service disruption, data interception, or unauthorized access to systems relying on DNS resolution.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized modifications to DNS records. Attackers could inject malicious records into shared zone templates, potentially redirecting traffic or enabling DNS hijacking. This may lead to data breaches, unauthorized access to sensitive information, or disruption of services, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade PowerDNS-Admin to v2026.11.0 or later. Review all zone templates for unauthorized changes. Restrict User-role accounts from modifying templates. Monitor for suspicious DNS record injections in zones created from shared templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...