Executive brief
CoreDNS is a widely used DNS server that provides name resolution for networks and cloud environments. A security flaw allows attackers to bypass authentication when using modern encrypted connection methods like DNS-over-HTTPS or DNS-over-TLS. This could allow unauthorized users to access restricted network information or private zone data that should be protected by security policies.
Technical details
The CoreDNS 'tsig' plugin contains an authentication bypass vulnerability when handling non-plain-DNS transports, including DNS-over-TLS (DoT), DNS-over-HTTPS (DoH/DoH3), DNS-over-QUIC (DoQ), and gRPC. The root cause is that the tsig plugin incorrectly trusts the transport writer's TsigStatus() method instead of performing its own cryptographic verification. In the affected transports, the writer's status either always returns 'nil' (indicating success) or fails to properly initialize the TSIG secret on the server object. An unauthenticated remote attacker can exploit this by sending DNS queries with invalid or missing TSIG metadata over these encrypted transports to bypass 'require all' policies. This allows unauthorized access to restricted zone data or privileged queries. The issue is resolved in CoreDNS version 1.14.3.
Affected products
- CoreDNS CoreDNS < 1.14.3
Timeline
- 2026-04-22: patched: Version 1.14.3 released
- 2026-04-25: advisory: GitHub Security Advisory GHSA-qhmp-q7xh-99rh published
- 2026-05-05: disclosed: CVE-2026-33190 published to NVD