PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24029 Powerdns CVE debrief

CVE-2026-24029 is a MEDIUM severity vulnerability in Powerdns Dnsdist. The early_acl_drop option is disabled by default on a DNS over HTTPs frontend using the nghttp2 provider, allowing all clients to send DoH queries regardless of the configured ACL. This could potentially bypass access controls and allow unauthorized access to DNS services. Users of Powerdns Dnsdist should be aware of this vulnerability and take recommended actions to mitigate the risk. The vulnerability exists due to a configuration oversight in the nghttp2 provider, which does not enforce ACL checks when the early_acl_drop option is disabled.

Vendor
Powerdns
Product
Dnsdist
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-25
Advisory published
2026-03-31
Advisory updated
2026-07-25

Who should care

Users of Powerdns Dnsdist, particularly those with exposed deployments, should be aware of this vulnerability and take recommended actions to mitigate the risk. This includes reviewing and updating ACL configurations, enabling the early_acl_drop option if not already enabled, and monitoring DNS traffic for unusual patterns. Security teams and operators managing DNS services should prioritize patching or applying mitigations to prevent potential unauthorized access.

Technical summary

The vulnerability exists in Powerdns Dnsdist when the early_acl_drop option is disabled on a DNS over HTTPs frontend using the nghttp2 provider. This allows all clients to send DoH queries regardless of the configured ACL, potentially bypassing access controls. The issue arises from the nghttp2 provider not enforcing ACL checks when the early_acl_drop option is disabled, which is the default configuration. This could lead to unauthorized access to DNS services if not properly mitigated.

Defensive priority

Medium priority due to the potential for unauthorized access to DNS services. Defenders should focus on reviewing configurations, applying patches, and monitoring traffic to mitigate this vulnerability.

Recommended defensive actions

  • Review and update the ACL configuration for Dnsdist instances
  • Enable the early_acl_drop option if not already enabled
  • Monitor DNS traffic for unusual patterns
  • Apply vendor patches or updates as available
  • Perform a thorough review of DNS service configurations and access controls

Evidence notes

The CVE record was published on 2026-03-31T12:16:27.633Z and last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. The early_acl_drop option is disabled by default on a DNS over HTTPs frontend using the nghttp2 provider. This CVE is considered under active attack. There is limited evidence of public exploitability. Defenders should verify affected product deployments and review official advisories for mitigation guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24029 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24029

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24029 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24029

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.