CVE-2026-93008
Last modified
CVE-2026-93008 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone.
Description
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ceph Storage 9 | All versions |
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 6 | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
| Red Hat | Red Hat OpenShift Container Platform 4 | All versions |
| Red Hat | Red Hat OpenShift Container Platform 5 | All versions |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | All versions |
| Red Hat | Red Hat OpenStack Platform 18.0 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-93008?
How severe is CVE-2026-93008?
How do I fix CVE-2026-93008?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92999The Click n Chat (Chat Widget Integration) WordPress plugin …5.3
- CVE-2026-9300A vulnerability has been found in omec-project amf up to 2.1…6.3
- CVE-2026-93000The SPS-Suite WordPress plugin through 1.4.0 does not saniti…6.8
- CVE-2026-93003The Web add-on's HTTP server searches the entire request pac…6.9
- CVE-2026-93006A flaw was found in dnsmasq. The TFTP server can serve the w…6.8
- CVE-2026-93007A flaw was found in dnsmasq. The TCP DNS service uses a smal…5.3
- CVE-2026-93009A flaw was found in dnsmasq. The DHCPv6 client hostname pars…4.3
- CVE-2026-9301A vulnerability was found in omec-project amf up to 2.1.1. T…6.3
- CVE-2026-93010A flaw was found in dnsmasq. When DHCP leasequery is enabled…4.3
- CVE-2026-93011A flaw was found in dnsmasq. After a reduction of internal d…5.3
- CVE-2026-93012Email::Sender::Transport::Sendmail versions before 2.602 for…9.8
- CVE-2026-93013RAGFlow through 0.27.2 contains a path traversal vulnerabili…4.3
Are you affected by CVE-2026-93008?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST