CVE-2026-0397
Low · 3.1CVSS
3.1
EPSS
0.2%
Published
Mar 31, 2026
CISA due date
—
The record
When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious website and extract information about the running configuration from the dashboard. The root cause of the issue is a misconfiguration of the Cross-Origin Resource Sharing (CORS) policy.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dnsdist | 0 | 1.9.13-160000.1.1 |
Related vulnerabilities
- CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code calls… Also affects dnsdist
- CVE-2026-33596 A client might theoretically be able to cause a mismatch between queries sent to a… Also affects dnsdist
- CVE-2026-33602 A rogue backend can send a crafted UDP response with a query ID off by one related to the… Also affects dnsdist
- CVE-2026-33599 A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers… Also affects dnsdist
- CVE-2026-33597 PRSD detection denial of service Also affects dnsdist
- CVE-2026-33254 An attacker can create a large number of concurrent DoQ or DoH3 connections, causing… Also affects dnsdist
- CVE-2026-33594 A client can trigger excessive memory allocation by generating a lot of queries that are… Also affects dnsdist
- CVE-2026-33595 A client can trigger excessive memory allocation by generating a lot of errors responses… Also affects dnsdist