p PatchFirst

CVE-2026-0397

CVE-2026-0397 · Information disclosure via CORS misconfiguration

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

CVSS 3.1 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dnsdist

    Versions
    • ≥ 1.9.0, < 1.9.12: Affected (semver)
    • ≥ 2.0.0, < 2.0.3: Affected (semver)

    Update to 1.9.12; Update to 2.0.3

  • dnsdist Debian:12

    Versions
    • 1.7.3-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-3
    • 1.9.10-1
    • 1.9.3-1
    • 1.9.4-1
    • 1.9.5-1
    • 1.9.6-1
    • 1.9.8-1
    • 1.9.9-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.3-1
    • 2.0.4-1
    • 2.0.5-1
    • 2.0.5-2
    • 2.0.5-3
    • 2.0.6-1
    • 2.1.0-1
    • 2.1.0-2
    • 2.1.1-1
    • 2.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Debian:13

    Versions
    • 1.9.10-1
    • 1.9.10-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.9.14-0+deb13u1

    Update to 1.9.14-0+deb13u1

  • dnsdist Debian:14

    Versions
    • 1.9.10-1
    • 2.0.0-1
    • 2.0.0-2
    • 2.0.0-3
    • 2.0.0-4
    • 2.0.0-5
    • 2.0.0-6
    • 2.0.0~rc1-1
    • 2.0.0~rc1-2
    • 2.0.0~rc2-1
    • 2.0.1-1
    • 2.0.2-1
    Affected ranges
    • ECOSYSTEM: < 2.0.3-1

    Update to 2.0.3-1

  • dnsdist Ubuntu:16.04:LTS

    Versions
    • 1.0.0~alpha2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.0-1
    • 1.2.0-3
    • 1.2.1-1
    • 1.2.1-1build1
    • 1.2.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.0~rc3-1
    • 1.4.0-1
    • 1.4.0-1build1
    • 1.4.0-1build2
    • 1.4.0-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:22.04:LTS

    Versions
    • 1.5.1-3build2
    • 1.6.1-1build1
    • 1.6.1-1ubuntu0.1~esm1
    • 1.6.1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:Pro:24.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.2-1
    • 1.8.2-2
    • 1.8.2-3
    • 1.8.3-1
    • 1.8.3-2
    • 1.8.3-2build1
    • 1.8.3-2build2
    • 1.8.3-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:25.10

    Versions
    • 1.9.8-1
    • 1.9.10-1
    • 1.9.10-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.10

    Versions
    • 2.0.2-1build1
    • 2.0.5-2ubuntu1
    • 2.0.5-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dnsdist Ubuntu:26.04:LTS

    Versions
    • 1.9.10-1
    • 2.0.1-1
    • 2.0.2-1
    • 2.0.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →