When DNSdist’s internal web admin interface is active, a misconfigured Cross-Origin Resource Sharing policy allows a malicious webpage to read configuration data that is normally protected by the dashboard API. An attacker can exploit this by luring an administrator who is logged in to the dashboard into visiting a crafted site, thereby leaking sensitive configuration information. The weakness is identified as a CORS policy flaw (CWE‑942), resulting in unintended data disclosure.

The vulnerability targets PowerDNS DNSdist. No explicit version range is provided in the advisory, so any build that includes the internal webserver and the default CORS policy may be affected. Administrators should check whether the webserver is running and whether the dashboard is exposed to external access.

The CVSS score of 3.1 indicates a low severity data‑exposure risk. An EPSS value below 1 % suggests that the probability of exploitation is very low, and the flaw does not appear in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves an authenticated administrator who visits a malicious webpage; this component of the attack is inferred, not directly documented in the advisory. While the impact is limited to data disclosure, appropriate mitigations remain advisable.