CVE-2026-93010

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

This vulnerability is rated as Low because leasequery is opt-in, the unrestricted-source behavior is documented, and lease inventory is not high-sensitivity data (much of it is already visible via ARP and other LAN protocols). Confidentiality impact is Low rather than High. Red Hat default dnsmasq configurations do not enable --leasequery. Current RHEL and RHIVOS packages ship dnsmasq 2.90 or earlier, which do not include the leasequery feature introduced in v2.92.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following measures reduce risk:

1. Prefer --leasequery=<addr>[/prefix] so only designated relays may query.
2. If leasequery is not needed, do not enable it. It is off by default.
3. If unrestricted leasequery is required, use firewall rules to limit which hosts can send DHCP packets to dnsmasq.