Quick answers
- Is CVE-2026-41999 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41999 being exploited in the wild.
- How severe is CVE-2026-41999?
- Medium severity, with a CVSS score of 4.8, published 21 May 2026.
- Which products and versions are affected?
- PowerDNS Authoritative Server.
- Is there a fix for CVE-2026-41999?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-41999 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-41999?
- Check whether you run Powerdns Authoritative Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
PowerDNS Authoritative Server is vulnerable to a logic error in how it processes 'views' (split-horizon DNS) when requests are received via the TCP PROXY protocol. The root cause is an incorrect mapping or validation of the source IP address provided in the PROXY header against the configured DNS views. An unauthenticated remote attacker can exploit this by sending specially crafted TCP PROXY requests to bypass source-based access controls or view-based restrictions. This could result in the disclosure of internal DNS records or the modification of expected query results. The vulnerability requires the PROXY protocol to be enabled and relies on a high-complexity attack vector involving specific network configurations.
Affected products
- PowerDNS Authoritative Server
Timeline
- 2026-05-21: disclosed: Initial advisory publication