Is CVE-2026-119658 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119658 being exploited in the wild.

How severe is CVE-2026-119658?

Medium severity, with a CVSS score of 4.3, published 30 October 2026.

Which products and versions are affected?

PowerDNS-Admin through 2026.08.1.

Is there a fix for CVE-2026-119658?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119658 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119658?

Check whether you run PowerDNS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119658: PowerDNS-Admin authorization bypass in secondary zone refresh

CVE-2026-119658 · Severity: medium · CVSS 4.3 · Published 2026-10-30

PowerDNS-Admin is a web interface for managing DNS zones. Authenticated users with limited access to one zone can bypass authorization controls to refresh secondary zones they should not have access to, potentially exposing DNS data from other zones or confirming their existence. An attacker with any zone access can enumerate and attack other organizations' secondary DNS zones.

Vendors: Powerdns.

Quick answers

Is CVE-2026-119658 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119658 being exploited in the wild.
How severe is CVE-2026-119658?: Medium severity, with a CVSS score of 4.3, published 30 October 2026.
Which products and versions are affected?: PowerDNS-Admin through 2026.08.1.
Is there a fix for CVE-2026-119658?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119658 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119658?: Check whether you run PowerDNS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

PowerDNS-Admin fails to properly validate zone ownership when processing secondary zone refresh requests, allowing authenticated User-role accounts to supply an arbitrary 'domain' field in the JSON request body to target unauthorized zones. An attacker authorized for any single zone can trigger AXFR-retrieve transfers of secondary zones belonging to other users and infer zone existence from HTTP response differences. The vulnerability affects the zone refresh endpoint in the domain model.

Affected products

PowerDNS PowerDNS-Admin through 2026.08.1

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.