Is CVE-2026-125378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125378 being exploited in the wild.

How severe is CVE-2026-125378?

Medium severity, with a CVSS score of 4.3, published 10 November 2026.

Which products and versions are affected?

PowerDNS-Admin before 2026.11.0.

Is there a fix for CVE-2026-125378?

Yes: fixed in 2026.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125378 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125378?

Check whether you run PowerDNS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125378: PowerDNS-Admin missing authorization in template records handler

CVE-2026-125378 · Severity: medium · CVSS 4.3 · Published 2026-11-10

PowerDNS-Admin is a web interface for managing DNS zones through PowerDNS. A missing authorization check allows any authenticated user with basic User role to modify shared DNS zone templates, injecting malicious DNS records (NS, MX, A, CNAME) that propagate to all zones created from the affected template. This could redirect domain traffic or cause service disruption for organizations relying on those templates.

Vendors: Powerdns.

Quick answers

Is CVE-2026-125378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125378 being exploited in the wild.
How severe is CVE-2026-125378?: Medium severity, with a CVSS score of 4.3, published 10 November 2026.
Which products and versions are affected?: PowerDNS-Admin before 2026.11.0.
Is there a fix for CVE-2026-125378?: Yes: fixed in 2026.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125378 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125378?: Check whether you run PowerDNS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.11.0

Technical details

The /admin/template/<template>/apply endpoint in the apply_records handler fails to verify that the authenticated user has authorization to modify the template resource. An authenticated User-role account can exploit this authorization bypass to replace DNS record sets in shared templates by name, with the modified records affecting all zones subsequently created from the compromised template. The vulnerability allows injection of attacker-controlled NS, MX, A, and CNAME records.

Affected products

PowerDNS PowerDNS-Admin before 2026.11.0

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.