CVE-2026-93010
Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
- State
- Published
- Severity
- 4.3 Medium
- Published
- Oct 29, 2026
- Updated
- Oct 30, 2026
- Reserved
- Sep 17, 2026
Description
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Red Hat Ceph Storage 9Red Hat | |
Red Hat Enterprise Linux 10Red Hat | |
Red Hat Enterprise Linux 6Red Hat | |
Red Hat Enterprise Linux 7Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 5Red Hat | |
Red Hat OpenShift Container Platform 5Red Hat | |
Red Hat OpenStack Platform 13 (Queens)Red Hat | |
Red Hat OpenStack Platform 18.0Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-93010vdb-entry
- RHBZ#2536081issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.