Medium severity · published Oct 29, 2026
CVE-2026-93010
Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
New
4.3
CVSS
–
EPSS
No
On KEV
Description
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Ceph Storage 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenStack Platform 13 (Queens) · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenStack Platform 18.0 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93010
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-93010
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2536081
More from Red Hat Ceph Storage 9
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.8
CVE-2026-41242
protobufjs has an arbitrary code execution issue
9.8
CVE-2026-27459
pyOpenSSL DTLS cookie callback buffer overflow
9.1
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
9.1
CVE-2026-39832
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent