Bug 2536081 (CVE-2026-93010) - CVE-2026-93010 dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
Summary: CVE-2026-93010 dnsmasq: dnsmasq: --leasequery without address argument applie...
Keywords:
Status: NEW
Alias: CVE-2026-93010
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 14:54 UTC by OSIDB Bzimport
Modified: 2026-10-28 09:32 UTC (History)
35 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 14:54:35 UTC 
A missing authorization check was found in dnsmasq's DHCPLEASEQUERY handler (src/rfc2131.c). When --leasequery is specified without an address argument, option parsing (src/option.c) sets OPT_LEASEQUERY but leaves daemon->leasequery_addr NULL. The source-address ACL is gated on leasequery_addr being non-NULL, so the check is skipped and any LAN host can send DHCPLEASEQUERY and receive lease records (IP, MAC, hostname, client ID, vendor class, relay agent ID).

The feature is off by default. The man page documents the address argument as optional. This is closer to a hardening gap than a default-config vulnerability. Red Hat default package configurations do not enable --leasequery.

Affected versions: v2.92 onwards. Feature not present in v2.91 and earlier.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743
Note You need to log in before you can comment on or make changes to this bug.