Skip to content

Poweradmin

v4.2.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo DNS & Service Discovery
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

dns-administration pdns powerdns powerdns-admin powerdns-web-gui powerdns-webui
+1 more
web

Affected surfaces

auth

ReleasePort's take

Light signal
editorial:auto 1mo

Authentication callback URLs now derive from the configured application URL instead of trusting the request Host header, mitigating potential header‑spoofing attacks.

Why it matters: Prevents attackers from manipulating Host headers to hijack authentication callbacks; critical for all deployments using OIDC/SAML (severity 80).

Summary

AI summary

Updates Records, templates and search, API and permissions, and Other across a mixed release.

Changes in this release

Security High

Authentication callback URLs now built from configured interface.application_url, no longer trust request Host header.

Authentication callback URLs now built from configured interface.application_url, no longer trust request Host header.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Low

LUA template records now applied to IPv4 reverse zones.

LUA template records now applied to IPv4 reverse zones.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Low

Add‑zone flow retains reverse context.

Add‑zone flow retains reverse context.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Feature Low

CSV export quotes leading special characters in cells.

CSV export quotes leading special characters in cells.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Medium

Permission templates validated on user create/update, preventing self‑elevation.

Permission templates validated on user create/update, preventing self‑elevation.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Medium

Zone listing in internal API and V1 API now scoped to zones the user can see.

Zone listing in internal API and V1 API now scoped to zones the user can see.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Medium

DNSSEC operations now require full edit permission and zone ownership.

DNSSEC operations now require full edit permission and zone ownership.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Medium

SOA, NS, and apex records remain pinned to the top of the record list regardless of sort order.

SOA, NS, and apex records remain pinned to the top of the record list regardless of sort order.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Low

Zone template sync clears stale zone_template_sync rows when a zone's template changes and reconciles sync for all owners of a shared zone.

Zone template sync clears stale zone_template_sync rows when a zone's template changes and reconciles sync for all owners of a shared zone.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Bugfix Low

Search query now qualifies ORDER BY column to avoid ambiguous‑column errors and sorts grouped results correctly on PostgreSQL.

Search query now qualifies ORDER BY column to avoid ambiguous‑column errors and sorts grouped results correctly on PostgreSQL.

Source: llm_adapter@2026-06-07

Confidence: high

 —
Full changelog

✨ Highlights

Patch release for the stable 4.2.x line. Focus is authentication callback-URL hardening, API-mode and permission scoping, and record, template and search fixes.

🐛 Fixes

Authentication

  • OIDC and SAML URLs (OIDC redirect_uri, OIDC post-logout redirect, and the SAML ACS/SLO/entityID plus the API docs base URL) are now built from the configured interface.application_url instead of the request Host header. The fallback no longer trusts request-time Host headers, so these URLs can't be altered per request. Set application_url to keep them stable.

API and permissions

  • Permission templates are validated on user create/update, and perm_templ can no longer be set in a way that allows self-elevation; users with broken templates are now surfaced (#1219).
  • Zone listing in both the internal API and V1 API is scoped to zones the user can actually see.
  • DNSSEC operations now require full edit permission and zone ownership.

Records, templates and search

  • SOA, NS and apex records stay pinned to the top of the record list regardless of sort column or direction (#1250).
  • LUA template records are applied to IPv4 reverse zones (#1248).
  • Zone template sync clears stale zone_template_sync rows when a zone's template changes (#1249), and reconciles sync for all owners of a shared zone.
  • Add-zone flow keeps reverse context (#1225).
  • Search qualifies the ORDER BY column to fix an ambiguous-column error (#1224) and sorts grouped results correctly on PostgreSQL.
  • CSV export quotes leading special characters in cells.

Other

  • Localization fills in remaining record-add and DNS validation messages.

📦 Upgrading

Drop-in replacement for v4.2.3. PHP 8.2+ required (unchanged).

Full changelog: https://github.com/poweradmin/poweradmin/compare/v4.2.3...v4.2.4

Security Fixes

  • OIDC and SAML callback URLs (redirect_uri, post‑logout redirect, ACS/SLO/entityID, API docs base URL) built from configured `interface.application_url` instead of request Host header, preventing per‑request tampering
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Poweradmin

Get notified when new releases ship.

Sign up free

About Poweradmin

A web-based control panel for PowerDNS

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]