What is CVE-2026-0397?

CVE-2026-0397 is a low-severity vulnerability in Powerdns Dnsdist, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 3.1/10. Published 2026-03-31.

How severe is CVE-2026-0397?

Low severity. CVSS v3 base score is 3.1 out of 10.

Vulnerability in Powerdns Dnsdist

CVE-2026-0397

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

EPSS: 0.002 (5.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.

Affected products

Powerdns Dnsdist — versions 1.9.0, 2.0.0

Weakness classification (CWE)

CWE-942 — Permissive Cross-domain Policy with Untrusted Domains

References

security@open-xchange.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-0397?: CVE-2026-0397 is a low-severity vulnerability in Powerdns Dnsdist, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 3.1/10. Published 2026-03-31.
How severe is CVE-2026-0397?: Low severity. CVSS v3 base score is 3.1 out of 10.