Code-execution

Poweradmin is the PHP web panel a large share of PowerDNS operators use to manage zones, and it is often run multi-tenant. We pointed KLUE, our security agent, at it and found seven separate ways its security controls fail. One lets a tenant with a normal Zone Manager role run code as root on the DNS server through a LUA record. Four more hand out full Administrator through SSO or the user-creation path. The last two let a restricted editor rewrite a zone apex and let an attacker toggle DNSSEC over a forged GET. Four were assigned CVEs, all rated High (CVE-2026-115458, CVE-2026-115459, CVE-2026-115460, CVE-2026-115461), and three, including the Critical code execution, are fixed with CVEs still pending. The fixes shipped across the 3.9.12, 4.2.6, 4.3.5, and 4.4.1 releases, each finding in the releases on the branches it affects.

Hydra is the configuration framework a large part of the Python machine-learning world uses to wire up experiments and apps. We pointed KLUE, our AI security agent, at it, and it found two ways to run code on a machine that loads an untrusted Hydra config. Both get around the blocklist Hydra had already added to stop exactly this. One slips through gaps in that blocklist; the other goes through the logging system, a door the blocklist never guarded. Both were reported, accepted, assigned CVEs (CVE-2026-106441 and CVE-2026-106442), rated High, and fixed.