Is CVE-2026-26017 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26017 being exploited in the wild.

How severe is CVE-2026-26017?

High severity, with a CVSS score of 7.7, published 6 March 2026.

Which products and versions are affected?

CoreDNS < 1.14.2; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.2.

Is there a fix for CVE-2026-26017?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26017 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-26017?

Check whether you run CoreDNS, github.com/coredns/coredns (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26017: CoreDNS access control bypass via plugin execution order

Q: Which products and versions are affected?

CoreDNS < 1.14.2; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.2.

Q: Is there a fix for CVE-2026-26017?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-26017 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-26017?

Check whether you run CoreDNS, github.com/coredns/coredns (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26017 · Severity: high · CVSS 7.7 · Published 2026-03-06

CoreDNS is a widely used DNS server that handles domain name lookups, often within Kubernetes environments. A security flaw allows attackers to bypass access controls by using name-rewriting rules to reach restricted internal services. This could lead to unauthorized discovery of sensitive internal infrastructure and data exposure in multi-tenant environments.

Technologies: CoreDNS, github.com/coredns/coredns (Go), Red Hat Connectivity Link. Vendors: CoreDNS, Go, Red Hat.

Quick answers

Is CVE-2026-26017 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26017 being exploited in the wild.
How severe is CVE-2026-26017?: High severity, with a CVSS score of 7.7, published 6 March 2026.
Which products and versions are affected?: CoreDNS < 1.14.2; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.2.
Is there a fix for CVE-2026-26017?: Yes. github.com/coredns/coredns (Go): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26017 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-26017?: Check whether you run CoreDNS, github.com/coredns/coredns (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/coredns/coredns (Go): upgrade to 1.14.2 or later
```
go get github.com/coredns/coredns@v1.14.2
```

Technical details

A logical vulnerability exists in CoreDNS due to a Time-of-Check Time-of-Use (TOCTOU) flaw in its plugin execution order. Security plugins like 'acl' are evaluated before the 'rewrite' plugin, meaning access control decisions are made based on the original query name before it is normalized or modified. An attacker with low privileges can craft a DNS query that passes ACL checks but is subsequently rewritten to point to a restricted internal service, such as an administrative endpoint in a Kubernetes cluster. This allows for unauthorized service discovery and reconnaissance. The issue is fixed in CoreDNS version 1.14.2 by reordering the plugins so that normalization occurs before security checks.

Affected products

CoreDNS CoreDNS < 1.14.2
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat Red Hat Connectivity Link 1

Identifiers

CVE-2026-26017
GHSA-c9v3-4pv7-87pr
GO-2026-4630

Timeline

2026-03-06: disclosed
2026-03-06: patched: Fixed in CoreDNS v1.14.2
2026-03-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.