PowerDNS DNSdist exposes a configuration detail through a misconfigured Cross‑Origin Resource Sharing policy on its internal webserver. When the internal webserver is enabled, an attacker can trick an authenticated administrator into visiting a malicious page and cause the dashboard to send requests that reveal the runtime configuration data. The vulnerability allows an attacker to obtain sensitive information from the DNSdist system without affecting integrity or availability.

The affected product is PowerDNS DNSdist. The internal webserver is disabled by default but can be enabled by configuration. No specific version information is provided in the data, so any version that uses the internal webserver and contains the CORS defect could be impacted.

The CVSS score is 3.1, indicating low severity, and the EPSS score is less than 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires social engineering to get a logged‑in administrator to visit a malicious site; no remote code execution or privilege escalation is possible. The primary risk is the inadvertent disclosure of configuration data to an adversary.