CVE-2026-93008

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

This vulnerability is rated as Important because it enables arbitrary DNS cache poisoning (integrity high) that affects all clients trusting the cache (scope changed). Attack complexity is high because exploitation requires split-DNS (server=/domain/ip or local=/domain/) or similar trust-boundary configuration. Stock single-upstream deployments have no containment boundary to violate. DNSSEC does not mitigate this for unsigned victim zones. Red Hat products that ship dnsmasq as a DNS forwarder are affected when split-DNS or local= directives are used.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following measures reduce risk:

1. Do not point server=/domain/ at untrusted or attacker-reachable DNS servers.
2. Restrict dnsmasq to communicate only with trusted upstream resolvers at the firewall.
3. For local=/domain/ zones, define all names that should be served locally.
4. Do not rely on --dnssec to mitigate this for unsigned zones. Insecure records are still cached.