# CVE-2026-0396: PowerDNS DNSdist HTML injection in web dashboard

Source: https://junglewise.ai/threats/cve-2026-0396-powerdns-dnsdist-html-injection-in-web-dashboard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-0396 · Severity: low · CVSS 3.1 · Published 2026-03-31

PowerDNS DNSdist is a load balancer used to manage and route internet traffic for domain name services. A vulnerability in its management dashboard allows an attacker to inject malicious content into the administrative interface by sending specifically crafted network requests. If an administrator views the compromised dashboard, it could lead to unauthorized actions or the display of misleading information, though it does not directly grant full control over the server.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-0396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0396 being exploited in the wild.

**How severe is CVE-2026-0396?** Low severity, with a CVSS score of 3.1, published 31 March 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2.

**Is there a fix for CVE-2026-0396?** A patch was published on 2026-03-31. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0396 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-0396?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the PowerDNS DNSdist web dashboard due to improper neutralization of HTML tags (CWE-80). The issue is triggered when domain-based dynamic rules are enabled via 'DynBlockRulesGroup:setSuffixMatchRule' or 'DynBlockRulesGroup:setSuffixMatchRuleFFI'. An attacker can send crafted DNS queries that, when processed and displayed in the dashboard, inject arbitrary HTML. Exploitation requires the internal webserver to be enabled (it is disabled by default) and requires an administrator to interact with the dashboard. The vulnerability is fixed in versions 1.9.12 and 2.0.3.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2

## Timeline

- 2025-12-19: disclosed: Vulnerability discovered by Aisle Research
- 2026-03-31: advisory: PowerDNS Security Advisory 2026-02 published
- 2026-03-31: patched

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)