CVE-2026-0397 — Permissive Cross-domain Security Policy with Untrusted Domains in Dnsdist
Severity
3.1LOWNVD
EPSS
0.0%
top 98.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 31
Description
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4
Affected Packages2 packages
🔴Vulnerability Details
3GHSA▶
GHSA-gjv7-4r9p-7hmx: When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visitin↗2026-03-31
OSV▶
CVE-2026-0397: When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visitin↗2026-03-31
📋Vendor Advisories
1Debian▶
CVE-2026-0397: dnsdist - When the internal webserver is enabled (default is disabled), an attacker might ...↗2026
🕵️Threat Intelligence
1💬Community
2Bugzilla▶
CVE-2026-0397 dnsdist: dnsdist and PowerDNS: Information Disclosure via Cross-Origin Resource Sharing (CORS) Misconfiguration [epel-all]↗2026-03-31
Bugzilla▶
CVE-2026-0397 dnsdist: dnsdist and PowerDNS: Information Disclosure via Cross-Origin Resource Sharing (CORS) Misconfiguration [fedora-all]↗2026-03-31