Every CVE Search/ Get API key

CVE-2026-0397

Information disclosure via CORS misconfiguration

3.1 LowFix available

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.17%Up 0.2 points since Mar 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

Information disclosure via CORS misconfiguration

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
CVE-2026-0397
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-942
Updated
2026-11-02
EUVDEUVD-2026-17363 3.1

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
EUVD-2026-17363
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gjv7-4r9p-7hmx 3.1

When the internal webserver is enabled (default is disabled), an attacker might be able to trick...

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
GHSA-gjv7-4r9p-7hmx
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-942
Updated
2026-11-02
NVD 3.1

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
CVE-2026-0397
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-942
Updated
2026-11-02
OSVALPINE-CVE-2026-0397 4.3

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
ALPINE-CVE-2026-0397
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSV 3.1

Information disclosure via CORS misconfiguration

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
CVE-2026-0397
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-0397 4.3

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
DEBIAN-CVE-2026-0397
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-0397 3.1

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

Record
UBUNTU-CVE-2026-0397
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:21015-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
openSUSE-SU-2026:21015-1
Updated
2026-11-02
OSVSUSE-SU-2026:1618-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues:

Update to version 1.9.12.

Security issues fixed:

  • CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web dashboard (bsc#1261236).
  • CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS packet parsed by Lua code using newDNSPacketOverlay can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send DoH queries (bsc#1261239).
  • CVE-2026-24030: crafted DoQ and DoH3 queries can lead to unbounded memory allocation and DoS (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses sent to a DNSdist using certain methods in custom Lua code (changeName) can lead to an out-of-bounds write (bsc#1261243).
  • CVE-2026-27854: crafted DNS queries sent to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code can lead to a use-after-free (bsc#1261241).
Record
SUSE-SU-2026:1618-1
Updated
2026-11-02
OSVSUSE-SU-2026:22319-1 No score

Security update for dnsdist

This update for dnsdist fixes the following issues

  • CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236).
  • CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237).
  • CVE-2026-24028: crafted DNS response packet can lead to an out-of-bounds read (bsc#1261238).
  • CVE-2026-24029: HTTPS ACL bypass can allow clients to send DoH queries (bsc#1261239).
  • CVE-2026-24030: allocating too much memory while processing DNS can result in a denial of service (bsc#1261240).
  • CVE-2026-27853: crafted DNS responses can lead to an out-of-bounds write (bsc#1261241).
  • CVE-2026-27854: crafted DNS queries can be used to trigger a use-after-free (bsc#1261243).
  • CVE-2026-33254: Resource exhaustion via DoQ/DoH3 connections (bsc#1262538).
  • CVE-2026-33257: Insufficient input validation of internal webserver (bsc#1262536).
  • CVE-2026-33260: Insufficient input validation of internal webserver (bsc#1262537).
  • CVE-2026-33593: Denial of service via crafted DNSCrypt query (bsc#1262546).
  • CVE-2026-33594: Outgoing DoH excessive memory allocation (bsc#1262545).
  • CVE-2026-33595: DoQ/DoH3 excessive memory allocation (bsc#1262544).
  • CVE-2026-33596: TCP backend stream ID overflow (bsc#1262543).
  • CVE-2026-33597: PRSD detection denial of service (bsc#1262542).
  • CVE-2026-33598: Out-of-bounds read in cache inspection via Lua (bsc#1262541).
  • CVE-2026-33599: Out-of-bounds read in service discovery (bsc#1262540).
  • CVE-2026-33602: Off-by-one access when processing crafted UDP responses (bsc#1262539).

Changes for dnsdist:

  • Updated to 1.9.13
Record
SUSE-SU-2026:22319-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dnsdist
Alpine:v3.23
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Alpine:v3.24
 1.9.0 up to 2.0.4-r0
2.0.4-r0
dnsdist
Debian:12
 All versions, plus listed versions
1.7.3-21.8.0-11.8.1-11.8.2-11.8.2-2
Show 32 moreShow less
1.8.2-31.8.3-11.8.3-21.8.3-31.9.10-11.9.3-11.9.4-11.9.5-11.9.6-11.9.8-11.9.9-12.0.0-12.0.0-22.0.0-32.0.0-42.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-12.0.3-12.0.4-12.0.5-12.0.5-22.0.5-32.0.6-12.1.0-12.1.0-22.1.1-12.1.2-1
 None known
dnsdist
Debian:13
 before 1.9.14-0+deb13u1, plus listed versions
1.9.10-11.9.10-1+deb13u1
1.9.14-0+deb13u1
dnsdist
Debian:14
 before 2.0.3-1, plus listed versions
1.9.10-12.0.0-12.0.0-22.0.0-32.0.0-4
Show 7 moreShow less
2.0.0-52.0.0-62.0.0~rc1-12.0.0~rc1-22.0.0~rc2-12.0.1-12.0.2-1
2.0.3-1
dnsdist
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.9.12-150700.3.9.1
1.9.12-150700.3.9.1
dnsdist
SUSE:Linux Enterprise Server 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1
dnsdist
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0~alpha2-1
 None known
dnsdist
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2.0-11.2.0-31.2.1-11.2.1-1build11.2.1-1ubuntu0.1~esm1
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
dnsdist
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.0~rc3-11.4.0-11.4.0-1build11.4.0-1build21.4.0-1ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.5.1-3build21.6.1-1build11.6.1-1ubuntu0.1~esm11.6.1-1ubuntu0.1~esm2
 None known
dnsdist
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.8.0-11.8.2-11.8.2-21.8.2-31.8.3-1
Show 4 moreShow less
1.8.3-21.8.3-2build11.8.3-2build21.8.3-2ubuntu0.1~esm1
 None known
dnsdist
Ubuntu:25.10
 All versions, plus listed versions
1.9.8-11.9.10-11.9.10-1ubuntu0.1
 None known
dnsdist
Ubuntu:26.10
 All versions, plus listed versions
2.0.2-1build12.0.5-2ubuntu12.0.5-2ubuntu3
 None known
dnsdist
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.10-12.0.1-12.0.2-12.0.2-1build1
 None known
dnsdist
openSUSE:Leap 16.0
 before 1.9.13-160000.1.1
1.9.13-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-0397 is a low vulnerability (CVSS 3.1) in Powerdns Dnsdist, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in dnsdist 2.0.4-r0.

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open