CVE-2026-119658 PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

Medium 5.3 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119658?

CVE-2026-119658 is a medium-severity vulnerability in PowerDNS-Admin, published on 30 Oct 2026.

Official description

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

Weakness: CWE-639

Which versions are affected by CVE-2026-119658?

How do I fix CVE-2026-119658?

No fix has been published for CVE-2026-119658 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119658 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119658 exists.

Sources

Also known as GHSA-7x9g-4g72-fhmf.