# CVE-2026-0397: PowerDNS DNSdist information disclosure via CORS misconfiguration in dashboard

Source: https://junglewise.ai/threats/cve-2026-0397-powerdns-dnsdist-information-disclosure-via-cors-misconfiguration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-0397 · Severity: low · CVSS 3.1 · Published 2026-03-31

PowerDNS DNSdist is a load balancer used to manage and route DNS traffic. A security flaw in its optional web dashboard could allow an attacker to trick an administrator into visiting a malicious website, which then silently extracts configuration details from the dashboard. This could expose sensitive operational information about the network's DNS infrastructure.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-0397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0397 being exploited in the wild.

**How severe is CVE-2026-0397?** Low severity, with a CVSS score of 3.1, published 31 March 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2.

**Is there a fix for CVE-2026-0397?** A patch was published on 2026-03-31: Fixed versions 1.9.12 and 2.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0397 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-0397?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A misconfiguration of the Cross-Origin Resource Sharing (CORS) policy in the DNSdist internal webserver allows for information disclosure. If the internal webserver is enabled (it is disabled by default), an attacker can perform a cross-origin attack by tricking an authenticated administrator into visiting a malicious website. This allows the attacker's site to make requests to the DNSdist dashboard and extract the running configuration. The vulnerability affects versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2. It is fixed in versions 1.9.12 and 2.0.3. Users can also mitigate the risk by disabling the internal webserver.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.11, 2.0.0 to 2.0.2

## Timeline

- 2026-01-13: disclosed: Discovery date reported by vendor
- 2026-03-31: advisory: Vendor advisory and CVE published
- 2026-03-31: patched: Fixed versions 1.9.12 and 2.0.3 released

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html)

## Related threats

- [PowerDNS DNSdist EDNS options smuggling in EDNS processing](https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing)
- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)