Is CVE-2026-33190 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33190 being exploited in the wild.

How severe is CVE-2026-33190?

High severity, with a CVSS score of 7.5, published 5 May 2026.

Which products and versions are affected?

CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

Is there a fix for CVE-2026-33190?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33190 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-33190?

Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33190: CoreDNS tsig authentication bypass in encrypted transports

Q: Which products and versions are affected?

CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

Q: Is there a fix for CVE-2026-33190?

Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33190 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-33190?

Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33190 · Severity: high · CVSS 7.5 · Published 2026-05-05

CoreDNS is a widely used DNS server that provides name resolution for networks and cloud environments. A security flaw allows attackers to bypass authentication when using modern encrypted connection methods like DNS-over-HTTPS or DNS-over-TLS. This could allow unauthorized users to access restricted network information or private zone data that should be protected by security policies.

Technologies: CoreDNS, github.com/coredns/coredns (Go). Vendors: CoreDNS, Go.

Quick answers

Is CVE-2026-33190 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33190 being exploited in the wild.
How severe is CVE-2026-33190?: High severity, with a CVSS score of 7.5, published 5 May 2026.
Which products and versions are affected?: CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.
Is there a fix for CVE-2026-33190?: Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33190 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33190?: Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/coredns/coredns (Go): upgrade to 1.14.3 or later
```
go get github.com/coredns/coredns@v1.14.3
```

Technical details

The CoreDNS 'tsig' plugin contains an authentication bypass vulnerability when handling non-plain-DNS transports, including DNS-over-TLS (DoT), DNS-over-HTTPS (DoH/DoH3), DNS-over-QUIC (DoQ), and gRPC. The root cause is that the tsig plugin incorrectly trusts the transport writer's TsigStatus() method instead of performing its own cryptographic verification. In the affected transports, the writer's status either always returns 'nil' (indicating success) or fails to properly initialize the TSIG secret on the server object. An unauthenticated remote attacker can exploit this by sending DNS queries with invalid or missing TSIG metadata over these encrypted transports to bypass 'require all' policies. This allows unauthorized access to restricted zone data or privileged queries. The issue is resolved in CoreDNS version 1.14.3.

Affected products

CoreDNS CoreDNS < 1.14.3

Identifiers

CVE-2026-33190
GHSA-qhmp-q7xh-99rh
GO-2026-5583

Timeline

2026-04-22: patched: Version 1.14.3 released
2026-04-25: advisory: GitHub Security Advisory GHSA-qhmp-q7xh-99rh published
2026-05-05: disclosed: CVE-2026-33190 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.