1. Home
  2. CVE Database
  3. CVE-2026-0397
LOW · 3.1

CVE-2026-0397

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information abou...

Vulnerability Description

When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.

CVSS Score

3.1

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PowerdnsDnsdist>= 1.9.0, < 1.9.12

Related Weaknesses (CWE)

CWE-942

References

FAQ

What is CVE-2026-0397?

CVE-2026-0397 is a vulnerability with a CVSS score of 3.1 (LOW). When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information abou...

How severe is CVE-2026-0397?

CVE-2026-0397 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-0397?

Check the references section above for vendor advisories and patch information. Affected products include: Powerdns Dnsdist.