CVE-2020-14196
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting...
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
CVE-2020-14196- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
CVE-2020-14196- Updated
- 2026-11-02
EUVDEUVD-2020-6351 No score
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
EUVD-2020-6351- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fqf5-f2p3-h3j2 No score
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting...
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
GHSA-fqf5-f2p3-h3j2- Updated
- 2026-11-02
OSVALPINE-CVE-2020-14196
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
ALPINE-CVE-2020-14196- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
OSV
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
CVE-2020-14196- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2020-14196
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
DEBIAN-CVE-2020-14196- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-14196
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
- Record
UBUNTU-CVE-2020-14196- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0286 No score
Updated pdns-recursor packages fix security vulnerability
Updated pdns-recursor package fixes security vulnerability:
An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the restriction (CVE-2020-14196).
In the default configuration the API webserver is not enabled. Only installations using a non-default value for webserver and webserver-address are affected.
- Record
MGASA-2020-0286- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1005-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
- CVE-2020-14196: Fixed an access restriction bypass with API key and password authentication (boo#1173302).
- Record
openSUSE-SU-2020:1005-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1055-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
- CVE-2020-14196: Fixed an access restriction bypass with API key and password authentication (boo#1173302).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:1055-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1101-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
- CVE-2020-14196: Fixed an access restriction bypass with API key and password authentication (boo#1173302).
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2020:1101-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1687-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
-pdns-recursorwas updated to 4.1.1 and 4.3.5:
- CVE-2020-25829: Fixed a cache pollution related to DNSSEC validation (boo#1177383)
- CVE-2020-14196: Fixed an access restriction bypass with API key and password authentication (boo#1173302).
- Record
openSUSE-SU-2020:1687-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11157-1 No score
pdns-recursor-4.5.5-1.3 on GA media
These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11157-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.12 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.13 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.14 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.15 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.16 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.17 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.18 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.19 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.20 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.21 |
before 4.3.2-r0 | 4.3.2-r0 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.22 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.23 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorAlpine:v3.24 |
before 4.3.2-r0 | 4.3.2-r0 |
pdns-recursorDebian:12 |
before 4.3.2-1 | 4.3.2-1 |
pdns-recursorDebian:13 |
before 4.3.2-1 | 4.3.2-1 |
pdns-recursorDebian:14 |
before 4.3.2-1 | 4.3.2-1 |
pdns-recursorDebian:10 |
before 4.1.11-1+deb10u2, plus listed versions 4.1.11-14.1.11-1+deb10u1 |
4.1.11-1+deb10u2 |
pdns-recursorMageia:7 |
before 4.1.17-1.mga7 | 4.1.17-1.mga7 |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
pdns-recursorUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 |
None known |
pdns-recursorSUSE:Package Hub 12 SP1 |
before 4.1.12-bp151.4.6.1 | 4.1.12-bp151.4.6.1 |
pdns-recursorSUSE:Package Hub 15 SP1 |
before 4.1.12-bp151.4.6.1 | 4.1.12-bp151.4.6.1 |
pdns-recursoropenSUSE:Leap 15.1 |
before 4.1.12-bp151.4.6.1 | 4.1.12-bp151.4.6.1 |
pdns-recursoropenSUSE:Leap 15.2 |
before 4.1.12-bp151.4.6.1 | 4.1.12-bp151.4.6.1 |
pdns-recursorSUSE:Package Hub 15 SP2 |
before 4.1.12-bp152.2.4.1 | 4.1.12-bp152.2.4.1 |
pdns-recursorSUSE:Package Hub 15 SP2 |
before 4.3.2-bp152.2.8.1 | 4.3.2-bp152.2.8.1 |
pdns-recursorSUSE:Package Hub 12 SP1 |
before 4.3.5-bp152.2.12.1 | 4.3.5-bp152.2.12.1 |
pdns-recursorSUSE:Package Hub 15 SP1 |
before 4.3.5-bp152.2.12.1 | 4.3.5-bp152.2.12.1 |
pdns-recursorSUSE:Package Hub 15 SP2 |
before 4.3.5-bp152.2.12.1 | 4.3.5-bp152.2.12.1 |
pdns-recursoropenSUSE:Leap 15.1 |
before 4.3.5-bp152.2.12.1 | 4.3.5-bp152.2.12.1 |
pdns-recursoropenSUSE:Leap 15.2 |
before 4.3.5-bp152.2.12.1 | 4.3.5-bp152.2.12.1 |
pdns-recursoropenSUSE:Tumbleweed |
before 4.5.5-1.3 | 4.5.5-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14196 is a medium vulnerability (CVSS 5.3) in Powerdns Recursor, published July 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in pdns-recursor 4.3.2-r0.
References
openwall.com/lists/oss-security/2020/07/01/1
doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00043.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TUNCUZNASYSTVD35QGFAI6XO2BFMQ2F
Show 36 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-14196
github.com/advisories/GHSA-fqf5-f2p3-h3j2
security.alpinelinux.org/vuln/CVE-2020-14196
security-tracker.debian.org/tracker/CVE-2020-14196
advisories.mageia.org/MGASA-2020-0286.html
bugs.mageia.org/show_bug.cgi?id=26887
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-04.html
ubuntu.com/security/CVE-2020-14196
cve.org/CVERecord?id=CVE-2020-14196
bugzilla.suse.com/1173302
suse.com/security/cve/CVE-2020-14196