CVE-2026-33608

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
PowerDNS	Authoritative	>= 5.0.0, < 5.0.4; >= 4.9.0, < 4.9.14

References

https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.htmlBroken Link, Vendor Advisory

Timeline

Published: Apr 22, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-336096.5Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.CVE-2026-33616.4The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up CVE-2026-336107.5A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a CVE-2026-336114.9An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn c CVE-2026-336127.5A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.CVE-2026-336138.8Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the gene CVE-2026-336147.5An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutra CVE-2026-336159.1An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutra CVE-2026-336167.5An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper CVE-2026-336175.3An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confid CVE-2026-336188.8Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's CVE-2026-336195.5PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side reque