What’s Vulnerable › Vulnerabilities

CVE-2026-93010: Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-30
• Weakness: CWE-862

Description

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Ceph Storage 9: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 6: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat OpenShift Container Platform 5: all versions
• Red Hat OpenStack Platform 13 (Queens): all versions
• Red Hat OpenStack Platform 18.0: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-93010
• https://bugzilla.redhat.com/show_bug.cgi?id=2536081

Get alerted when CVE-2026-93010 or the next vulnerability affects your stack