CVE-2026-52686

3.7 LOW

Published: July 23, 2026 Modified: July 23, 2026

Description

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html

Source: security@open-xchange.com

1 reference(s) from NVD

Quick Stats

CVSS v3 Score

3.7 / 10.0

Exploitation Status

Not in CISA KEV