CVE-2026-52686

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

Score

CVSS 3.1 3.7 Low

Status

Awaiting Analysis - security@open-xchange.com

Published

2026-07-23

Last modified

2026-10-24

Weaknesses

CWE-345, CWE-347

Affected products

• Recursor (Powerdns)

References

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html