Security Advisory catalog CVE-2026-93010 Historical advisory recorded 29 Oct 2026 15:12:12 UTC. Read the latest advisory .
cve-program · CVE-2026-93010 Published
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-93010 Published rhceph/alloy-rhel10 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Ceph Storage 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhceph/alloy-rhel10",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
} openshift4/ose-baremetal-runtimecfg-rhel8 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-baremetal-runtimecfg-rhel8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} openshift4/ose-baremetal-runtimecfg-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-baremetal-runtimecfg-rhel9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} openshift/ose-rhel-coreos-8 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-8",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} dnsmasq https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 13 (Queens)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dnsmasq",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openstack:13"
]
} rhoso-operators/infra-rhel9-operator https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 18.0",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoso-operators/infra-rhel9-operator",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
]
} Original source record · Cite this exact observation · Complete original publisher JSON