Insufficient verification of data authenticity in PowerDNS Recursor - CVE-2026-85555
Published: October 21, 2026
Vulnerability identifier: #VU156686
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85555
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass DNSSEC validation and poison the DNS cache in PowerDNS Recursor.
The vulnerability exists due to insufficient verification of data authenticity in DNSSEC validation when resolving an NS name that refers to an out-of-band local zone. A remote attacker can exploit the validation exemption extending beyond NS name resolution to have subsequent query processing skip DNSSEC validation and permit cache poisoning.
Affected software
PowerDNS Recursor
How to mitigate CVE-2026-85555
Install security update from vendor's website.
PowerDNS Recursor - addressed in versions 5.3.12, 5.4.8