CVE-2026-33612 Overview
CVE-2026-33612 is a cache poisoning vulnerability in the PowerDNS Recursor ZoneToCache function. A malicious authoritative DNS server can return a crafted zone that the recursor ingests, allowing attacker-controlled records to be inserted into the resolver cache. The issue maps to [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data]. Successful exploitation undermines the integrity of DNS responses returned to downstream clients, enabling traffic redirection and downstream attacks against services that rely on resolver answers.
Critical Impact
A remote authoritative server operator can poison the recursor cache through the ZoneToCache ingestion path, compromising DNS response integrity for all clients of the resolver.
Affected Products
- PowerDNS Recursor (per PowerDNS Security Advisory 2026-08)
- Deployments using the ZoneToCache feature to preload zones from authoritative servers
- Recursors configured to retrieve zones from untrusted or attacker-controlled authoritative servers
Discovery Timeline
- 2026-06-25 - CVE-2026-33612 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-33612
Vulnerability Analysis
The PowerDNS Recursor includes a ZoneToCache feature that retrieves entire DNS zones from an authoritative source and stores the records directly in the resolver cache. This bypasses the standard iterative resolution path and the validation checks typically applied to individual answers. When the source authoritative server is malicious or compromised, it can return records that fall outside the bailiwick of the requested zone. The recursor then treats these extraneous records as trusted cache entries, classifying this as [CWE-349]. The result is cache poisoning across arbitrary names, not just those delegated to the malicious server.
Root Cause
The ZoneToCache function accepts records returned by the authoritative server without sufficient filtering to confirm that each record belongs to the zone being loaded. Out-of-bailiwick records are accepted alongside legitimate ones and inserted into the shared cache. This violates the trust boundary between zone-scoped data and the global resolver cache.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker must operate or compromise an authoritative server that a target recursor is configured to load via ZoneToCache. The attacker crafts a zone response containing records for names outside the loaded zone. When the recursor ingests the response, those records replace or shadow legitimate entries in the cache and are returned to subsequent client queries. The attack complexity is high because the attacker must control an authoritative source the operator has explicitly trusted.
No verified public proof-of-concept code is available. Refer to the PowerDNS Security Advisory 2026-08 for vendor technical details.
Detection Methods for CVE-2026-33612
Indicators of Compromise
- Cache entries in PowerDNS Recursor containing records for domains outside the zones configured in ZoneToCache
- DNS responses to clients that resolve well-known domains to unexpected IP addresses
- Logs showing ZoneToCache transfers from authoritative servers immediately preceding anomalous resolutions
Detection Strategies
- Audit the ZoneToCache configuration and enumerate every authoritative source the recursor trusts for preloaded zones
- Compare recursor cache contents against expected zone contents to identify out-of-bailiwick records
- Correlate DNS query telemetry with passive DNS data to detect deviations from authoritative answers
Monitoring Recommendations
- Forward PowerDNS Recursor logs, including zone transfer events, to a central analytics platform for review
- Alert on ZoneToCache operations sourced from servers outside an approved allowlist
- Track sudden changes in resolution results for high-value domains served by the recursor
How to Mitigate CVE-2026-33612
Immediate Actions Required
- Review the PowerDNS Recursor ZoneToCache configuration and remove any authoritative sources that are not fully trusted and operated by your organization
- Apply the patched PowerDNS Recursor release referenced in PowerDNS Security Advisory 2026-08 as soon as it is available for your distribution
- Flush the recursor cache after patching to remove any potentially poisoned entries
Patch Information
PowerDNS has published Security Advisory 2026-08 covering this issue. Operators should consult the advisory for the specific fixed versions and upgrade their Recursor deployments accordingly.
Workarounds
- Disable the ZoneToCache feature if it is not strictly required by the deployment
- Restrict ZoneToCache sources to authoritative servers under direct administrative control, transported over authenticated channels
- Place network controls between the recursor and any external authoritative server used for zone preloading to limit exposure
# Configuration example: review and disable untrusted ZoneToCache entries
# Inspect current recursor configuration
grep -i zonetocache /etc/powerdns/recursor.conf
# After patching, clear the cache to evict potentially poisoned records
rec_control wipe-cache '$'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
