redhat ceph-storage CVE-2026-93010 vulnerability in Red Hat Products
Published on October 29, 2026

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 44 days later.

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-93010 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-93010

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Ceph Storage
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift
 
Red Hat Openstack
 

Affected Versions

Red Hat Ceph Storage 9: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 18.0: