Is CVE-2026-93006 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93006 being exploited in the wild.

How severe is CVE-2026-93006?

Medium severity, with a CVSS score of 6.8, published 29 October 2026.

Which products and versions are affected?

Dnsmasq 2.92 and later with TFTP compiled in.

How is CVE-2026-93006 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-93006?

Check whether you run Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93006: dnsmasq TFTP cache confusion serves wrong file

CVE-2026-93006 · Severity: medium · CVSS 6.8 · Published 2026-10-29

dnsmasq is a lightweight DNS and TFTP server commonly used in network infrastructure and PXE boot environments. A cache bug in the TFTP server can cause it to serve previously transferred file contents to new clients instead of the correct files. An attacker on the local network can exploit this to redirect boot images, potentially compromising machines during network boot or exfiltrating sensitive files.

Vendors: Dnsmasq.

Quick answers

Is CVE-2026-93006 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93006 being exploited in the wild.
How severe is CVE-2026-93006?: Medium severity, with a CVSS score of 6.8, published 29 October 2026.
Which products and versions are affected?: Dnsmasq 2.92 and later with TFTP compiled in.
Is there a fix for CVE-2026-93006?: No fixed version is recorded yet. If TFTP is not required, disable it by removing --enable-tftp from the configuration or compile without TFTP support using COPTS=-DNO_TFTP. If TFTP is required, restrict it to specific interfaces using --tftp-interface=<interface> and avoid TFTP-only instances serving untrusted clients on the same network.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93006 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-93006?: Check whether you run Dnsmasq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

If TFTP is not required, disable it by removing --enable-tftp from the configuration or compile without TFTP support using COPTS=-DNO_TFTP. If TFTP is required, restrict it to specific interfaces using --tftp-interface=<interface> and avoid TFTP-only instances serving untrusted clients on the same network.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}]

Technical details

The TFTP server in dnsmasq (v2.92 and later) fails to invalidate a recently used transfer cache when a transfer completes, leaving stale cached data indexed by a heap pointer that may be reused. An attacker on the adjacent network can request TFTP files to populate the cache, then wait for a legitimate client to request a different file and receive the attacker's cached content instead. The vulnerability requires DNS cache overwrites or heap reuse patterns to trigger; TFTP option negotiation (OACK) or mixed DNS/TFTP setups provide some mitigation, but TFTP-only PXE servers are highest risk.

Affected products

dnsmasq dnsmasq 2.92 and later with TFTP compiled in

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.