CVE-2026-0397 Information disclosure via CORS misconfiguration

Low 3.1 Published 31 Mar 2026 Updated 31 Mar 2026

An attacker can extract configuration data from the PowerDNS DNSdist dashboard via CORS misconfiguration if the internal webserver is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-0397?

CVE-2026-0397 is a low-severity vulnerability in PowerDNS DNSdist, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Weakness: CWE-942

Which versions are affected by CVE-2026-0397?

It affects 1 product.

Products include Powerdns Dnsdist.

How do I fix CVE-2026-0397?

Change a configuration setting.

Is CVE-2026-0397 being exploited?

There is no known exploitation of CVE-2026-0397 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-0397, GHSA-gjv7-4r9p-7hmx, UBUNTU-CVE-2026-0397.