CVE-2026-52686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52686", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-06-08T08:05:31.707Z", "datePublished": "2026-07-23T08:03:37.563Z", "dateUpdated": "2026-07-23T13:56:55.653Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-07-23T08:03:37.563Z"}, "title": "Wildcard CNAME proof validation bypass", "datePublic": "2026-07-21T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Recursor", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns-recursor", "repo": "https://github.com/PowerDNS/pdns", "modules": ["DNSSEC validation"], "programFiles": ["syncres.cc"], "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.12", "versionType": "semver"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.9", "versionType": "semver"}, {"status": "affected", "version": "5.4.0", "lessThan": "5.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.</p>"}]}], "references": [{"url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Qifan Zhang from Palo Alto Networks", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-347", "lang": "en", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T13:56:39.271508Z", "id": "CVE-2026-52686", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T13:56:55.653Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52686", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T13:56:39.271508Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T13:56:50.788Z"}}], "cna": {"title": "Wildcard CNAME proof validation bypass", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Qifan Zhang from Palo Alto Networks"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["DNSSEC validation"], "product": "Recursor", "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.12", "versionType": "semver"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.9", "versionType": "semver"}, {"status": "affected", "version": "5.4.0", "lessThan": "5.4.4", "versionType": "semver"}], "packageName": "pdns-recursor", "programFiles": ["syncres.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2026-07-21T22:00:00.000Z", "references": [{"url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.", "supportingMedia": [{"type": "text/html", "value": "<p>The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-07-23T08:03:37.563Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52686", "state": "PUBLISHED", "dateUpdated": "2026-07-23T13:56:55.653Z", "dateReserved": "2026-06-08T08:05:31.707Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2026-07-23T08:03:37.563Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected", "modules": ["DNSSEC validation"], "packageName": "pdns-recursor", "product": "Recursor", "programFiles": ["syncres.cc"], "repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "versions": [{"lessThan": "5.2.12", "status": "affected", "version": "5.2.0", "versionType": "semver"}, {"lessThan": "5.3.9", "status": "affected", "version": "5.3.0", "versionType": "semver"}, {"lessThan": "5.4.4", "status": "affected", "version": "5.4.0", "versionType": "semver"}]}], "source": "security@open-xchange.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record."}, {"lang": "es", "value": "El problema es una elusi\u00f3n de validaci\u00f3n de DNSSEC donde las pruebas de expansi\u00f3n de comod\u00edn (registros NSEC/NSEC3) son aceptadas sin validaci\u00f3n de firma cuando la respuesta de comod\u00edn es un registro CNAME o DNAME."}], "id": "CVE-2026-52686", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security@open-xchange.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52686", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T13:56:39.271508Z", "version": "2.0.3"}}]}, "published": "2026-07-23T09:16:26.967", "references": [{"source": "security@open-xchange.com", "url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "pdns-recursor: pdns-recursor: DNSSEC validation bypass due to unsigned wildcard expansion proofs", "id": "2506358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506358"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.", "A flaw was found in pdns-recursor. This vulnerability allows a remote attacker to bypass DNSSEC (Domain Name System Security Extensions) validation. The flaw occurs because the system accepts wildcard expansion proofs (NSEC/NSEC3 records) without proper signature validation when the wildcard answer is a CNAME (Canonical Name) or DNAME (Delegation Name) record. This can lead to an attacker providing forged DNS responses, potentially resulting in information integrity issues."], "name": "CVE-2026-52686", "public_date": "2026-07-23T08:03:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52686\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52686\nhttps://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html"], "statement": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the affected packages, refer to the linked references.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.0,5.2.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.3.0,5.3.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.0,5.4.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Recursor", "source": "cna", "vendor": "PowerDNS"}, "product": "recursor", "vendor": "powerdns"}], "created": "2026-07-23T09:30:16.625494+00:00", "updated": "2026-08-03T23:00:04.916798+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$recursor"]}