- Published on
Poweradmin is the PHP web panel a large share of PowerDNS operators use to manage zones, and it is often run multi-tenant. We pointed KLUE, our security agent, at it and found seven separate ways its security controls fail. One lets a tenant with a normal Zone Manager role run code as root on the DNS server through a LUA record. Four more hand out full Administrator through SSO or the user-creation path. The last two let a restricted editor rewrite a zone apex and let an attacker toggle DNSSEC over a forged GET. Four were assigned CVEs, all rated High (CVE-2026-115458, CVE-2026-115459, CVE-2026-115460, CVE-2026-115461), and three, including the Critical code execution, are fixed with CVEs still pending. The fixes shipped across the 3.9.12, 4.2.6, 4.3.5, and 4.4.1 releases, each finding in the releases on the branches it affects.