Junglewise Threat Intelligence

CVE-2026-26017: CoreDNS access control bypass via plugin execution order

CVE-2026-26017 · Severity: high · CVSS 7.7 · Published 2026-03-06

Technologies: github.com/coredns/coredns (Go), CoreDNS, Red Hat Connectivity Link. Vendors: Red Hat, Go, CoreDNS.

Executive brief

CoreDNS is a widely used DNS server that handles domain name lookups, often within Kubernetes environments. A security flaw allows attackers to bypass access controls by using name-rewriting rules to reach restricted internal services. This could lead to unauthorized discovery of sensitive internal infrastructure and data exposure in multi-tenant environments.

Technical details

A logical vulnerability exists in CoreDNS due to a Time-of-Check Time-of-Use (TOCTOU) flaw in its plugin execution order. Security plugins like 'acl' are evaluated before the 'rewrite' plugin, meaning access control decisions are made based on the original query name before it is normalized or modified. An attacker with low privileges can craft a DNS query that passes ACL checks but is subsequently rewritten to point to a restricted internal service, such as an administrative endpoint in a Kubernetes cluster. This allows for unauthorized service discovery and reconnaissance. The issue is fixed in CoreDNS version 1.14.2 by reordering the plugins so that normalization occurs before security checks.

Affected products

  • CoreDNS CoreDNS < 1.14.2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Connectivity Link 1

Timeline

  • 2026-03-06: disclosed
  • 2026-03-06: patched: Fixed in CoreDNS v1.14.2
  • 2026-03-06: advisory

References

Related threats