CVE-2026-0396: 
NixOS vulnerability analysis and mitigation

CVE-2026-0396 is an HTML injection vulnerability in PowerDNS DNSdist that allows an unauthenticated remote attacker to inject malicious HTML content into the internal web dashboard by sending crafted DNS queries. It affects DNSdist versions 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2, and is only exploitable when domain-based dynamic rules are enabled via DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI. The vulnerability was published on March 31, 2026. It carries a CVSS v3.1 base score of 3.1–4.3 (Low to Medium, depending on scoring authority), with the GitHub Advisory and ENISA scoring it at 3.1 (GitHub Advisory, DNSdist Advisory).

The root cause is improper neutralization of script-related HTML tags in a web page (CWE-80 / CWE-79), where domain names from DNS queries are reflected unsanitized into the DNSdist internal web dashboard. When domain-based dynamic blocking rules are active, the domain portion of incoming DNS queries is processed and displayed in the dashboard without adequate output encoding, enabling HTML injection. Exploitation requires network access to the DNSdist instance to send crafted DNS queries, and a user must subsequently view the affected dashboard page (user interaction required). No public proof-of-concept code has been identified (GitHub Advisory, DNSdist Advisory).

Successful exploitation allows an attacker to inject arbitrary HTML content into the DNSdist internal web dashboard, potentially displaying deceptive or malicious content to administrators who view it. The impact is limited to low integrity loss — there is no confidentiality or availability impact, and the scope is unchanged. While the vulnerability does not enable direct code execution or data exfiltration, it could be leveraged for phishing or UI redressing attacks targeting dashboard users (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.003% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have network access to the DNSdist instance and the target feature (domain-based dynamic rules) to be enabled, further limiting the attack surface (GitHub Advisory, DNSdist Advisory).

1. Reconnaissance: Identify a DNSdist instance (versions 1.9.0–1.9.11 or 2.0.0–2.0.2) that has domain-based dynamic rules enabled via DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI and has the internal web dashboard accessible.
2. Craft malicious DNS query: Construct a DNS query where the queried domain name contains HTML tags or payloads (e.g., <img src=x onerror=alert(1)>.example.com), designed to be reflected in the dashboard.
3. Send crafted query: Transmit the crafted DNS query to the target DNSdist instance over the network. The domain name is processed by the dynamic rule engine and recorded for display.
4. Wait for user interaction: The injected HTML is rendered when an administrator or authorized user views the internal web dashboard, triggering the injected content in their browser (DNSdist Advisory, GitHub Advisory).

• Network: Unusual DNS queries containing HTML special characters (<, >, ", ') or tag-like strings in the queried domain name directed at the DNSdist instance.
• Logs: DNSdist query logs showing domain names with embedded HTML syntax (e.g., domains containing angle brackets or script-like patterns) that triggered dynamic block rules.
• Web Dashboard: Unexpected HTML rendering artifacts, broken layout, or unfamiliar content appearing in the DNSdist internal web dashboard after DNS query activity.

PowerDNS has released patched versions DNSdist 1.9.12 and 2.0.3, which address this vulnerability. Administrators should upgrade to these versions as the primary remediation (DNSdist Advisory, PowerDNS Blog). As a workaround, disable domain-based dynamic rules (DynBlockRulesGroup:setSuffixMatchRule / DynBlockRulesGroup:setSuffixMatchRuleFFI) if not required, restrict network access to the DNSdist instance to trusted sources, and limit access to the internal web dashboard to authorized personnel only.

The vulnerability was disclosed alongside the DNSdist 1.9.12 and 2.0.3 release announcement on the PowerDNS blog, and was reported to the oss-security mailing list. Red Hat tracked it via Bugzilla and assessed it as medium severity. Downstream distributions including openSUSE, Fedora, Debian, and FreeBSD issued security updates or advisories shortly after disclosure (PowerDNS Blog, Red Hat Bugzilla).