CVE-2026-52686

LOW3.7

Published 2026-07-23 · Updated 2026-07-23 · Source security@open-xchange.com

Description

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-347

References

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-66011
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.
2026-07-25 · score 3.3
CVE-2026-17039
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
2026-07-24 · score 3.1
CVE-2026-12690
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
2026-07-24 · score 3.8
CVE-2026-15687
A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.
2026-07-23 · score 2.4
CVE-2026-64800
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
2026-07-23 · score 3.5