# CVE-2026-41999: PowerDNS Authoritative Server incorrect view handling with TCP PROXY

Source: https://junglewise.ai/threats/cve-2026-41999-powerdns-authoritative-server-incorrect-view-handling-with-tcp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-41999 · Severity: medium · CVSS 4.8 · Published 2026-05-21

A vulnerability in PowerDNS Authoritative Server can cause the system to incorrectly handle DNS 'views' when receiving requests via the TCP PROXY protocol. This could allow an attacker to bypass intended network segmentation or access-control policies, potentially viewing DNS records they are not authorized to see. The issue primarily affects environments using load balancers or proxies that pass client information via the PROXY protocol.

Technologies: [Powerdns Authoritative Server](https://junglewise.ai/threats/technologies/authoritative-server). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-41999 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41999 being exploited in the wild.

**How severe is CVE-2026-41999?** Medium severity, with a CVSS score of 4.8, published 21 May 2026.

**Which products and versions are affected?** PowerDNS Authoritative Server.

**Is there a fix for CVE-2026-41999?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41999 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-41999?** Check whether you run Powerdns Authoritative Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PowerDNS Authoritative Server is vulnerable to a logic error in how it processes 'views' (split-horizon DNS) when requests are received via the TCP PROXY protocol. The root cause is an incorrect mapping or validation of the source IP address provided in the PROXY header against the configured DNS views. An unauthenticated remote attacker can exploit this by sending specially crafted TCP PROXY requests to bypass source-based access controls or view-based restrictions. This could result in the disclosure of internal DNS records or the modification of expected query results. The vulnerability requires the PROXY protocol to be enabled and relies on a high-complexity attack vector involving specific network configurations.

## Affected products

- PowerDNS Authoritative Server

## Timeline

- 2026-05-21: disclosed: Initial advisory publication

## References

- [https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html](https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html)

## Related threats

- [PowerDNS Authoritative Server denial of service in internal web server](https://junglewise.ai/threats/cve-2026-42005-powerdns-authoritative-server-denial-of-service-in-internal-web)
- [PowerDNS Authoritative Server denial of service in catalog zone transfer](https://junglewise.ai/threats/cve-2026-42396-powerdns-authoritative-server-denial-of-service-in-catalog-zone)
- [PowerDNS Authoritative Server denial of service in GSS-TSIG](https://junglewise.ai/threats/cve-2026-42002-powerdns-authoritative-server-denial-of-service-in-gss-tsig)
- [PowerDNS Authoritative Server insufficient validation of Autoprimary SOA queries](https://junglewise.ai/threats/cve-2026-42001-powerdns-authoritative-server-insufficient-validation-of)
- [PowerDNS Authoritative Server insufficient name validation in AXFR](https://junglewise.ai/threats/cve-2026-42000-powerdns-authoritative-server-insufficient-name-validation-in)