# CVE-2026-33190: CoreDNS tsig authentication bypass in encrypted transports

Source: https://junglewise.ai/threats/cve-2026-33190-coredns-tsig-authentication-bypass-in-encrypted-transports  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33190 · Severity: high · CVSS 7.5 · Published 2026-05-05

CoreDNS is a widely used DNS server that provides name resolution for networks and cloud environments. A security flaw allows attackers to bypass authentication when using modern encrypted connection methods like DNS-over-HTTPS or DNS-over-TLS. This could allow unauthorized users to access restricted network information or private zone data that should be protected by security policies.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-33190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33190 being exploited in the wild.

**How severe is CVE-2026-33190?** High severity, with a CVSS score of 7.5, published 5 May 2026.

**Which products and versions are affected?** CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

**Is there a fix for CVE-2026-33190?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33190 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33190?** Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.3 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.3
  ```


## Technical details

The CoreDNS 'tsig' plugin contains an authentication bypass vulnerability when handling non-plain-DNS transports, including DNS-over-TLS (DoT), DNS-over-HTTPS (DoH/DoH3), DNS-over-QUIC (DoQ), and gRPC. The root cause is that the tsig plugin incorrectly trusts the transport writer's TsigStatus() method instead of performing its own cryptographic verification. In the affected transports, the writer's status either always returns 'nil' (indicating success) or fails to properly initialize the TSIG secret on the server object. An unauthenticated remote attacker can exploit this by sending DNS queries with invalid or missing TSIG metadata over these encrypted transports to bypass 'require all' policies. This allows unauthorized access to restricted zone data or privileged queries. The issue is resolved in CoreDNS version 1.14.3.

## Affected products

- CoreDNS CoreDNS < 1.14.3

## Identifiers

- CVE-2026-33190
- GHSA-qhmp-q7xh-99rh
- GO-2026-5583

## Timeline

- 2026-04-22: patched: Version 1.14.3 released
- 2026-04-25: advisory: GitHub Security Advisory GHSA-qhmp-q7xh-99rh published
- 2026-05-05: disclosed: CVE-2026-33190 published to NVD

## References

- [https://github.com/coredns/coredns/releases/tag/v1.14.3](https://github.com/coredns/coredns/releases/tag/v1.14.3)
- [https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh](https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh)

## Related threats

- [CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc)
- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)