Bug 2536081 (CVE-2026-93010)

Summary:	CVE-2026-93010 dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, eglynn, flucifre, gmeno, groman, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 14:54:35 UTC

A missing authorization check was found in dnsmasq's DHCPLEASEQUERY handler (src/rfc2131.c). When --leasequery is specified without an address argument, option parsing (src/option.c) sets OPT_LEASEQUERY but leaves daemon->leasequery_addr NULL. The source-address ACL is gated on leasequery_addr being non-NULL, so the check is skipped and any LAN host can send DHCPLEASEQUERY and receive lease records (IP, MAC, hostname, client ID, vendor class, relay agent ID).

The feature is off by default. The man page documents the address argument as optional. This is closer to a hardening gap than a default-config vulnerability. Red Hat default package configurations do not enable --leasequery.

Affected versions: v2.92 onwards. Feature not present in v2.91 and earlier.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743