CVE-2026-0397: 
NixOS vulnerability analysis and mitigation

CVE-2026-0397 is an information disclosure vulnerability in PowerDNS dnsdist caused by a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy in its optional internal webserver. When the internal webserver is enabled (it is disabled by default), an attacker can trick an authenticated administrator into visiting a malicious website, allowing the attacker to extract sensitive running configuration information from the dashboard. Affected versions include dnsdist 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2; fixed versions are 1.9.12 and 2.0.3. The vulnerability was published on March 31, 2026, with a CVSS v3.1 base score of 3.1 (Low) per the GitHub Advisory (GitHub Advisory, PowerDNS Advisory).

The root cause is classified under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) and CWE-346 (Origin Validation Error), where the dnsdist internal webserver fails to properly restrict which origins are permitted to make cross-origin requests to the dashboard API. An attacker exploits this by hosting a malicious webpage that issues JavaScript-based cross-origin requests to the dnsdist dashboard; because the CORS policy is overly permissive, the browser allows the response to be read by the attacker's page. Exploitation requires the internal webserver to be enabled, the administrator to be authenticated to the dashboard, and the administrator to be socially engineered into visiting the attacker-controlled site (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in limited confidentiality impact — specifically, an attacker can read information about the running dnsdist configuration from the dashboard. There is no integrity or availability impact. The attack surface is constrained by the requirement that the internal webserver be enabled (non-default) and that an authenticated administrator be tricked into visiting a malicious site, limiting the practical risk to environments where the webserver feature is actively used (GitHub Advisory, PowerDNS Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.01% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify targets running PowerDNS dnsdist with the internal webserver enabled (non-default configuration), typically accessible on a configured port (e.g., 8083).
2. Craft malicious page: Create a webpage containing JavaScript that issues cross-origin fetch/XMLHttpRequest calls to the dnsdist dashboard API endpoint (e.g., http://<dnsdist-host>:<port>/api/v1/servers/localhost/config).
3. Social engineering: Trick an authenticated dnsdist administrator into visiting the malicious page while they are logged into the dashboard — for example, via a phishing email or link.
4. Exploit CORS misconfiguration: Because the dnsdist webserver does not properly restrict allowed origins, the browser permits the cross-origin response to be read by the attacker's JavaScript.
5. Exfiltrate configuration data: The malicious page reads the API response containing running configuration details and transmits it to an attacker-controlled server (GitHub Advisory, PowerDNS Advisory).

• Network: Unexpected cross-origin HTTP requests to the dnsdist internal webserver port (e.g., 8083) originating from browser sessions with Origin headers pointing to external or unknown domains; outbound connections from administrator workstations to unfamiliar external hosts shortly after dashboard access.
• Logs: dnsdist webserver access logs showing API endpoint requests (e.g., /api/v1/servers/localhost/config) with Origin headers from domains not matching the expected management network; repeated API calls in short succession from the same session.
• Process/Configuration: dnsdist running with webserver directive enabled in configuration — verify with dnsdist --config or configuration file review.

PowerDNS has released patched versions dnsdist 1.9.12 and 2.0.3, which correct the CORS misconfiguration. Organizations should upgrade to these versions as the primary remediation. As an immediate workaround, disable the internal webserver if it is not required (it is disabled by default). Additional hardening measures include implementing Content Security Policy (CSP) headers, restricting dashboard access to trusted network segments, and educating administrators about phishing and social engineering risks (PowerDNS Advisory, GitHub Advisory).

PowerDNS published a release announcement for dnsdist 1.9.12 and 2.0.3 on March 31, 2026, addressing this and potentially other issues. Red Hat tracked the vulnerability via Bugzilla and assessed it as low severity. The vulnerability received routine coverage from Linux security news aggregators (linuxsecurity.com, pro-linux.de) and was picked up by FreeBSD and Fedora package maintainers for downstream updates. No significant researcher commentary or social media discussion beyond standard vulnerability tracking has been observed (PowerDNS Blog, Red Hat Bugzilla).