CVE-2026-0397 - Information disclosure via CORS misconfiguration

Back Back to CVE browser

MEDIUM

Information disclosure via CORS misconfiguration

Published Mar 31, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Affected products

Vendor PowerDNS Product DNSdist Default
unaffected
- Version
  1.9.0
  Status
  affected
  Constraints
  <1.9.12
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PowerDNS

DNSdist

unaffected

Version	Status	Constraints
1.9.0	affected	<1.9.12
2.0.0	affected	<2.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-942

References (1)

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html
Vendor Advisory

Link	Providers	Tags
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner OX

Published Mar 31, 2026

Updated Mar 31, 2026

Reserved Nov 28, 2025

Link CVE-2026-0397

CISA Vulnrichment

Updated Mar 31, 2026

NVD

Status Analyzed

Modified Jul 25, 2026

Link CVE-2026-0397

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-0397