Is CVE-2026-52688 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52688 being exploited in the wild.

How severe is CVE-2026-52688?

High severity, with a CVSS score of 7.5, published 23 July 2026.

Which products and versions are affected?

Powerdns Recursor 5.2.0 to 5.2.11, 5.3.0 to 5.3.8, 5.4.0 to 5.4.3.

Is there a fix for CVE-2026-52688?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52688 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-52688?

Check whether you run Powerdns Recursor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52688: PowerDNS Recursor DNSSEC wildcard validation bypass in RRSIG processing

CVE-2026-52688 · Severity: high · CVSS 7.5 · Published 2026-07-23

PowerDNS Recursor, a tool used by internet service providers to look up website addresses, contains a security flaw in how it verifies digital signatures for certain domain names. An attacker could exploit this to bypass security checks (DNSSEC), potentially allowing them to redirect users to malicious websites or provide false information. This could lead to users unknowingly visiting fraudulent sites or experiencing service disruptions.

Technologies: Powerdns Recursor. Vendors: Powerdns.

Quick answers

Is CVE-2026-52688 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52688 being exploited in the wild.
How severe is CVE-2026-52688?: High severity, with a CVSS score of 7.5, published 23 July 2026.
Which products and versions are affected?: Powerdns Recursor 5.2.0 to 5.2.11, 5.3.0 to 5.3.8, 5.4.0 to 5.4.3.
Is there a fix for CVE-2026-52688?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52688 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-52688?: Check whether you run Powerdns Recursor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the DNSSEC validation logic of PowerDNS Recursor, specifically within the 'validate.cc' component. The issue arises when processing RRSIG records that contain too few labels, which can lead to a bypass of wildcard validation. A remote, unauthenticated attacker can exploit this flaw by providing specially crafted DNS responses to a recursor performing validation. Successful exploitation allows the attacker to inject forged DNS data that should have been rejected by DNSSEC, compromising the integrity of name resolution. The vulnerability is addressed in versions 5.2.12, 5.3.9, and 5.4.4.

Affected products

PowerDNS Recursor 5.2.0 to 5.2.11, 5.3.0 to 5.3.8, 5.4.0 to 5.4.3

Timeline

2026-07-23: disclosed
2026-07-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.