{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Dangling DNS record",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shed riot"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Summary\n\nThe hostname resolved to an address within a dynamic cloud IP pool.\nThe address had been released and was no longer controlled by the\norganisation operating the hostname.\n\nThis condition is referred to as an \"afterlife\" issue.\n\nUnlike a conventional CNAME-based subdomain takeover, the DNS record\npointed directly to a reusable cloud IP address. An attacker obtaining\nthat address could receive traffic intended for the Microsoft-owned\nhostname and serve content from it.\n\nI reported the issue to the Microsoft Security Response Center as:\nVULN-198489\n\nMSRC closed the report as a non-MSRC case, because the IP address was\nnot in Azure. Doh.\n\n\n# Vulnerability\n\nPersistent dangling DNS record to a reusable cloud IP address.\nCWE-16: Configuration\n\n\n# Impact\n\nImpact includes:\n\n* obtaining trusted TLS certificates for the affected hostname;\n* serving attacker-controlled content from a trusted hostname;\n* receiving traffic intended for the previous service;\n* exposure of cookies, bearer tokens or session identifiers;\n* exposure of request bodies, API keys or webhook payloads;\n* abuse of CORS, OAuth or other domain-based allowlists;\n* abuse of same-site cookie and browser trust relationships; and\n* phishing or malware hosted under the organisation\u0027s domain.\n\n\n## Proof of Concept (PoC)\n\n1. open a browser and navigate to\n   `https://bastion.certb.cdp.bethesda.net`\n2. an `afterlife` holding page will be served from the affected\n   hostname\n3. observe that the browser reports a valid trusted TLS certificate\n   for the affected hostname\n4. navigate to `https://crt.sh/?q=bastion.certb.cdp.bethesda.net`\n   and observe that a new Let\u0027s Encrypt certificate has been issued\n   (may require a few refreshes as over-subscribed)\n5. navigate to `https://bethesda.net/` and login (create an account\n   if required)\n6. navigate to `https://bastion.certb.cdp.bethesda.net/request.txt`\n   and observe that the full request is displayed, along with the\n   domain scoped cookies that were received\n\n\n# Vendor response and timeline\n\n30 June 2026\n\nI submitted the report as VULN-198489.\n\nThe portal did not assign an MSRC case number. The recorded status was\n\"Complete - NA\".\n\nMSRC\u0027s rejected the issue as outside MSRC\u0027s scope, because the IP was\nnot in Azure.\n\n\n# References\n\n* MSRC submission VULN-198489\n* CWE-16: Configuration\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-16",
              "description": "CWE-16",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/35"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/35"
        },
        {
          "url": "https://bastion.certb.cdp.bethesda.net/request.txt`"
        },
        {
          "url": "https://bastion.certb.cdp.bethesda.net`"
        },
        {
          "url": "https://bethesda.net/`"
        },
        {
          "url": "https://crt.sh/?q=bastion.certb.cdp.bethesda.net`"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/35"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dangling DNS record for bastion.certb.cdp.bethesda.net",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0019",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/35",
            "automated": true,
            "contentSha256": "0bb12a8a2f62ec5315cb65d2653f08b92fa3d56f9fb83b993e49fd47900a5ea1",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/35",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-24T09:43:16Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-07T13:20:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0019"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}