CVE-2026-93008
Description
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.
Statement
This vulnerability is rated as Important because it enables arbitrary DNS cache poisoning (integrity high) that affects all clients trusting the cache (scope changed). Attack complexity is high because exploitation requires split-DNS (server=/domain/ip or local=/domain/) or similar trust-boundary configuration. Stock single-upstream deployments have no containment boundary to violate. DNSSEC does not mitigate this for unsigned victim zones. Red Hat products that ship dnsmasq as a DNS forwarder are affected when split-DNS or local= directives are used.
Mitigation
The following measures reduce risk:
1. Do not point server=/domain/ at untrusted or attacker-reachable DNS servers.
2. Restrict dnsmasq to communicate only with trusted upstream resolvers at the firewall.
3. For local=/domain/ zones, define all names that should be served locally.
4. Do not rely on --dnssec to mitigate this for unsigned zones. Insecure records are still cached.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
Reporter scored 7.5 (AC:L, S:U). RH scores 6.8 (AC:H, S:C): split-DNS or local= is required, and poisoned cache entries affect downstream clients in a different security domain.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Varies by Context; Unexpected State
Acknowledgements
Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
