CVE-2026-24029: 
NixOS vulnerability analysis and mitigation

CVE-2026-24029 is an Access Control List (ACL) bypass vulnerability in PowerDNS dnsdist affecting DNS over HTTPS (DoH) frontends using the nghttp2 provider. When the early_acl_drop option (known as earlyACLDrop in Lua) is explicitly disabled — note that it is enabled by default — the ACL check is entirely skipped, allowing any client to send DoH queries regardless of configured access restrictions. Affected versions are dnsdist 1.9.0 through 1.9.11 and 2.0.0 through 2.0.2. The vulnerability was disclosed on March 31, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, dnsdist Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-1220 (Insufficient Granularity of Access Control): when early_acl_drop is disabled, the code path responsible for enforcing ACL rules on the DoH frontend is bypassed entirely rather than falling back to a default-deny posture (GitHub Advisory). The vulnerability is network-exploitable with no authentication or user interaction required (attack complexity: Low). The precondition for exploitation is that an administrator must have explicitly set early_acl_drop to disabled on a DoH frontend using the nghttp2 provider — deployments using the default configuration are not affected (dnsdist Advisory). No public proof-of-concept exploit code has been identified (Feedly).

Successful exploitation allows unauthorized clients — including those that should be blocked by ACL policies — to send arbitrary DNS over HTTPS queries to the affected dnsdist instance. This results in limited confidentiality impact (unauthorized access to DNS resolution capabilities, potential information disclosure through DNS query patterns) and limited integrity impact (ability to make DNS queries that should have been denied). Availability is not directly impacted, though unrestricted query access could contribute to resource exhaustion in some configurations (GitHub Advisory, dnsdist Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.003%, indicating a very low probability of exploitation in the near term. Exploitation is constrained by the requirement that the early_acl_drop option must have been explicitly disabled by an administrator, limiting the attack surface to misconfigured deployments (dnsdist Advisory).

1. Reconnaissance: Identify internet-facing dnsdist instances running versions 1.9.0–1.9.11 or 2.0.0–2.0.2 with a DoH frontend using the nghttp2 provider. Tools such as Shodan or Censys can be used to locate exposed DoH endpoints.
2. Verify misconfiguration: Confirm that the target has early_acl_drop disabled by attempting DoH queries from an IP address that should be blocked by the configured ACL. A successful DNS response indicates the ACL is not being enforced.
3. Send unauthorized DoH queries: Craft and send HTTPS-based DNS queries (RFC 8484) to the DoH endpoint (typically on port 443) from a client IP that would normally be denied by the ACL.
4. Achieve objective: Use the unrestricted DoH access to perform DNS resolution for internal or otherwise restricted domains, potentially gathering network topology information or bypassing DNS-based security controls (dnsdist Advisory).

• Network: Unexpected HTTPS/DoH traffic (port 443) to the dnsdist DoH endpoint originating from IP addresses that are listed in the configured ACL deny rules; DNS queries from unauthorized IP ranges arriving via the DoH frontend.
• Logs: dnsdist query logs showing DoH requests from IP addresses that should have been blocked by ACL rules; absence of ACL-drop log entries for traffic that should have triggered them when early_acl_drop is disabled.
• Configuration: Review of dnsdist configuration files revealing setEarlyACLDrop(false) or early_acl_drop=no on a DoH frontend using the nghttp2 provider (dnsdist Advisory).

PowerDNS has released patched versions dnsdist 1.9.12 and 2.0.3, which address this vulnerability (dnsdist Advisory, PowerDNS Blog). As an immediate workaround, administrators should ensure the early_acl_drop option (earlyACLDrop in Lua) is enabled on all DoH frontends using the nghttp2 provider — this is the default setting, so only deployments that explicitly disabled it are affected. Administrators should audit their dnsdist configurations to confirm this setting and upgrade to a patched version as soon as possible (Red Hat Bugzilla).

PowerDNS published a security advisory and corresponding release announcement for dnsdist 1.9.12 and 2.0.3 on March 31, 2026, addressing this and potentially other issues (PowerDNS Blog). The vulnerability was also disclosed via the oss-security mailing list and tracked by Red Hat's security team (Red Hat Bugzilla). Downstream distributions including Fedora, Debian, and FreeBSD subsequently issued updated packages. No significant social media controversy or notable independent researcher commentary has been observed beyond standard vulnerability tracking.