# CVE-2026-26017: CoreDNS access control bypass via plugin execution order

Source: https://junglewise.ai/threats/cve-2026-26017-coredns-access-control-bypass-via-plugin-execution-order  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-06. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-26017 · Severity: high · CVSS 7.7 · Published 2026-03-06

CoreDNS is a widely used DNS server that handles domain name lookups, often within Kubernetes environments. A security flaw allows attackers to bypass access controls by using name-rewriting rules to reach restricted internal services. This could lead to unauthorized discovery of sensitive internal infrastructure and data exposure in multi-tenant environments.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns), [Red Hat Connectivity Link](https://junglewise.ai/threats/technologies/connectivity-link). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-26017 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26017 being exploited in the wild.

**How severe is CVE-2026-26017?** High severity, with a CVSS score of 7.7, published 6 March 2026.

**Which products and versions are affected?** CoreDNS < 1.14.2; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.2.

**Is there a fix for CVE-2026-26017?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26017 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-26017?** Check whether you run CoreDNS, github.com/coredns/coredns (Go) or Red Hat Connectivity Link at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.2 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.2
  ```


## Technical details

A logical vulnerability exists in CoreDNS due to a Time-of-Check Time-of-Use (TOCTOU) flaw in its plugin execution order. Security plugins like 'acl' are evaluated before the 'rewrite' plugin, meaning access control decisions are made based on the original query name before it is normalized or modified. An attacker with low privileges can craft a DNS query that passes ACL checks but is subsequently rewritten to point to a restricted internal service, such as an administrative endpoint in a Kubernetes cluster. This allows for unauthorized service discovery and reconnaissance. The issue is fixed in CoreDNS version 1.14.2 by reordering the plugins so that normalization occurs before security checks.

## Affected products

- CoreDNS CoreDNS < 1.14.2
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Red Hat Connectivity Link 1

## Identifiers

- CVE-2026-26017
- GHSA-c9v3-4pv7-87pr
- GO-2026-4630

## Timeline

- 2026-03-06: disclosed
- 2026-03-06: patched: Fixed in CoreDNS v1.14.2
- 2026-03-06: advisory

## References

- [https://github.com/coredns/coredns/releases/tag/v1.14.2](https://github.com/coredns/coredns/releases/tag/v1.14.2)
- [https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr](https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr)
- [https://access.redhat.com/errata/RHSA-2026:25127](https://access.redhat.com/errata/RHSA-2026:25127)
- [https://access.redhat.com/errata/RHSA-2026:8151](https://access.redhat.com/errata/RHSA-2026:8151)
- [https://access.redhat.com/security/cve/CVE-2026-26017](https://access.redhat.com/security/cve/CVE-2026-26017)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2445244](https://bugzilla.redhat.com/show_bug.cgi?id=2445244)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json)

## Related threats

- [CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc)
- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)