# CVE-2026-125378: PowerDNS-Admin missing authorization in template records handler

Source: https://junglewise.ai/threats/cve-2026-125378-powerdns-admin-before-2026-11-0-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125378 · Severity: medium · CVSS 4.3 · Published 2026-11-10

PowerDNS-Admin is a web interface for managing DNS zones through PowerDNS. A missing authorization check allows any authenticated user with basic User role to modify shared DNS zone templates, injecting malicious DNS records (NS, MX, A, CNAME) that propagate to all zones created from the affected template. This could redirect domain traffic or cause service disruption for organizations relying on those templates.

Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-125378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125378 being exploited in the wild.

**How severe is CVE-2026-125378?** Medium severity, with a CVSS score of 4.3, published 10 November 2026.

**Which products and versions are affected?** PowerDNS-Admin before 2026.11.0.

**Is there a fix for CVE-2026-125378?** Yes: fixed in 2026.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125378 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-125378?** Check whether you run PowerDNS-Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.11.0

## Technical details

The /admin/template/<template>/apply endpoint in the apply_records handler fails to verify that the authenticated user has authorization to modify the template resource. An authenticated User-role account can exploit this authorization bypass to replace DNS record sets in shared templates by name, with the modified records affecting all zones subsequently created from the compromised template. The vulnerability allows injection of attacker-controlled NS, MX, A, and CNAME records.

## Affected products

- PowerDNS PowerDNS-Admin before 2026.11.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/PowerDNS-Admin/PowerDNS-Admin](https://github.com/PowerDNS-Admin/PowerDNS-Admin)
- [https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/admin.py](https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/admin.py)

## Related threats

- [PowerDNS-Admin authorization bypass in secondary zone refresh](https://junglewise.ai/threats/cve-2026-119658-powerdns-admin-through-2026-08-1-contains-an-authorization)