CVE-2026-42001: DNS Autoprimary Information Disclosure

CVE-2026-42001 Overview

CVE-2026-42001 is a high-severity denial-of-service vulnerability affecting PowerDNS Authoritative Server. The flaw stems from insufficient validation of Start of Authority (SOA) queries received by the autoprimary functionality. A remote, unauthenticated attacker can send crafted SOA queries over the network to trigger conditions that disrupt service availability.

The vulnerability has a CVSS 3.1 base score of 7.5 and is exploitable across the network with low attack complexity and no privileges or user interaction required. The impact is limited to availability, with no confidentiality or integrity exposure. Refer to the PowerDNS Security Advisory 2026-06 for vendor guidance.

Critical Impact
Remote, unauthenticated attackers can cause a denial-of-service condition on PowerDNS Authoritative Server instances with the autoprimary feature enabled.

Affected Products

PowerDNS Authoritative Server (versions specified in the vendor advisory)
Deployments using the autoprimary (formerly supermaster) feature
Internet-facing authoritative DNS resolvers built on PowerDNS

Discovery Timeline

2026-05-21 - CVE-2026-42001 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-42001

Vulnerability Analysis

The vulnerability resides in PowerDNS Authoritative Server's handling of SOA queries within the autoprimary code path. The autoprimary mechanism allows a primary DNS server to notify secondary servers of zone updates, with the secondary issuing SOA queries to fetch zone metadata before transferring the zone.

When incoming SOA responses or related query parameters are processed without sufficient validation, the server can enter an error state that interrupts normal DNS service. The result is a denial of service against the authoritative DNS infrastructure, which can cascade into resolution failures for all zones hosted on the affected instance.

Because authoritative DNS underpins service reachability for the domains it serves, any disruption directly impacts dependent applications, email delivery, and web services. The vulnerability is classified as a Denial of Service issue with a network attack vector.

Root Cause

The root cause is improper input validation on SOA query data processed by the autoprimary feature. The code accepts and processes query content from network peers without enforcing the structural and semantic checks required to safely handle untrusted DNS protocol input.

Attack Vector

An attacker reaches the vulnerable code path by sending crafted DNS traffic to a PowerDNS Authoritative Server that has autoprimary enabled. No authentication or user interaction is required. Because DNS commonly traverses UDP and TCP port 53 on Internet-exposed infrastructure, exploitation can originate from any reachable network position.

No public proof-of-concept code is currently available. Defenders should consult the PowerDNS Security Advisory 2026-06 for protocol-level details and the precise conditions required to trigger the flaw.

Detection Methods for CVE-2026-42001

Indicators of Compromise

Unexpected restarts, crashes, or worker process terminations in PowerDNS Authoritative Server logs
Spikes in inbound SOA queries from unfamiliar source IP addresses or autonomous systems
Loss of DNS resolution for hosted zones coinciding with anomalous query patterns
Autoprimary error messages referencing malformed or unexpected SOA content

Detection Strategies

Monitor PowerDNS service availability and process uptime to identify abnormal restart cycles
Inspect DNS query telemetry for crafted or malformed SOA queries targeting autoprimary endpoints
Correlate DNS protocol anomalies with source reputation data to surface suspicious peers
Compare current PowerDNS release versions against those listed in the vendor advisory

Monitoring Recommendations

Forward PowerDNS logs and DNS query metadata to a centralized analytics platform for retention and correlation
Alert on repeated SOA queries from external sources to servers that should only accept autoprimary traffic from known primaries
Track service-level metrics such as queries-per-second drops and elevated SERVFAIL responses
Establish baselines for autoprimary traffic so deviations trigger investigation

How to Mitigate CVE-2026-42001

Immediate Actions Required

Apply the PowerDNS Authoritative Server update referenced in PowerDNS Security Advisory 2026-06
Inventory all PowerDNS Authoritative Server instances and identify those with the autoprimary feature enabled
Restrict network access to the DNS service so that only required peers can reach autoprimary endpoints
Validate backups and failover paths for authoritative DNS to reduce outage impact during patching

Patch Information

PowerDNS has published fixed releases in conjunction with PowerDNS Security Advisory 2026-06. Operators should upgrade to a patched version of PowerDNS Authoritative Server as defined in the vendor advisory. Review release notes before deploying changes to production resolvers.

Workarounds

Disable the autoprimary feature on servers that do not require it until patches are applied
Limit inbound DNS traffic from untrusted networks using firewall ACLs or DNS-aware filtering
Allowlist specific source IP addresses for primary-to-secondary communications where supported
Place authoritative servers behind upstream rate limiting to reduce exposure to volumetric crafted queries

bash

# Example: restrict inbound DNS to known primary sources using iptables
iptables -A INPUT -p udp --dport 53 -s <trusted_primary_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s <trusted_primary_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP