CVE-2026-42000: AXFR Insufficient Name Validation Flaw

CVE-2026-42000 Overview

CVE-2026-42000 is an insufficient input validation vulnerability in PowerDNS Authoritative Server. The flaw occurs during AXFR (DNS Authoritative Zone Transfer) operations, where the server fails to properly validate names received from a remote primary server. An attacker controlling an upstream primary can supply malformed or unexpected names during a zone transfer, causing integrity issues on the receiving secondary.

The vulnerability requires network access and conditions favorable to the attacker, but no authentication or user interaction. Successful exploitation impacts data integrity across a changed security scope, while confidentiality and availability are not directly affected.

Critical Impact
A malicious or compromised primary DNS server can inject invalid names into a secondary PowerDNS Authoritative Server via AXFR, corrupting zone data and undermining DNS integrity.

Affected Products

PowerDNS Authoritative Server (versions identified in the vendor advisory)
Deployments configured as secondary servers performing AXFR from upstream primaries
See the PowerDNS Security Advisory for the exact affected version ranges

Discovery Timeline

2026-05-21 - CVE-2026-42000 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-42000

Vulnerability Analysis

The vulnerability resides in the AXFR handling path of PowerDNS Authoritative Server. AXFR is the protocol used to replicate full DNS zone contents from a primary server to one or more secondaries. The receiving server must parse every resource record contained in the transfer, including owner names, RDATA names, and embedded labels.

PowerDNS does not sufficiently validate these names before accepting them into the zone. An attacker who controls or impersonates a primary server can send records that contain names violating DNS protocol constraints or expectations of downstream components. The receiving secondary stores or processes these records, propagating malformed data into its backend.

The issue is an input validation weakness rather than a memory safety flaw. Exploitation requires the attacker to reach the AXFR code path, which limits the attack surface to environments where an attacker can act as, or compromise, an upstream primary.

Root Cause

The root cause is missing or incomplete validation of DNS name fields in records received during AXFR. The parser accepts names that should be rejected, allowing invalid data to enter the authoritative zone store. Refer to the PowerDNS Security Advisory for the precise technical description.

Attack Vector

The attack vector is network-based and targets the secondary-to-primary AXFR relationship. An attacker must either operate a primary server that the victim trusts for transfers, compromise such a primary, or intercept and modify AXFR traffic in transit. Once positioned, the attacker delivers a crafted zone transfer containing records with insufficiently validated names. The receiving PowerDNS Authoritative Server ingests the records, resulting in integrity impact on the served zone and a scope change affecting downstream resolvers and clients.

No authenticated code execution example is published by the vendor. Technical details are restricted to the advisory, and no public proof-of-concept is available at this time.

Detection Methods for CVE-2026-42000

Indicators of Compromise

Unexpected resource records appearing in secondary zones after AXFR completion, including records with malformed or non-conformant owner names
AXFR sessions originating from primaries that do not match the expected also-notify or allow-axfr-from configuration
Backend database entries containing DNS labels that fail strict RFC 1035 name validation

Detection Strategies

Compare zone contents between primary and secondary after each AXFR and alert on records that fail an external strict-name validator
Enable PowerDNS query and transfer logging, then parse logs for AXFR completions followed by unusual record additions
Monitor DNS responses served by the secondary for names that deviate from the organization's expected naming policy

Monitoring Recommendations

Forward PowerDNS logs and zone-change events into a centralized analytics platform for correlation across primaries and secondaries
Track AXFR source IP addresses and alert on transfers from unauthorized peers or unexpected geographies
Baseline zone record counts and label patterns, then alert on statistical deviations after replication events

How to Mitigate CVE-2026-42000

Immediate Actions Required

Apply the fixed PowerDNS Authoritative Server release listed in the PowerDNS Security Advisory as soon as it is available for your distribution
Restrict AXFR sources using allow-axfr-from and TSIG keys so that only known, trusted primaries can initiate transfers
Audit existing zones for malformed records that may have been ingested before patching

Patch Information

PowerDNS has issued a security advisory under reference PowerDNS-Advisory-2026-06. Administrators should consult the PowerDNS Security Advisory for the fixed version numbers, upgrade instructions, and any backported packages provided for supported distributions.

Workarounds

Limit AXFR peers to a tightly controlled allowlist and require TSIG authentication on all transfers
Place authenticated transfer traffic inside an IPsec or VPN tunnel to prevent on-path injection of crafted AXFR responses
Use a pre-ingestion validation proxy or scripted post-transfer check that rejects zones containing records with non-conformant names

bash

# Configuration example: restrict AXFR sources and require TSIG
# /etc/powerdns/pdns.conf
allow-axfr-ips=192.0.2.10,198.51.100.5
disable-axfr=no
tcp-control-secret=<rotate-regularly>

# Per-zone TSIG enforcement via pdnsutil
pdnsutil set-meta example.com AXFR-MASTER-TSIG primary-tsig-key
pdnsutil set-meta example.com TSIG-ALLOW-AXFR primary-tsig-key