CVE-2026-35579: CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports

CVE-2026-35579 · Severity: critical · CVSS 9.8 · Published 2026-05-05

CoreDNS, a widely used DNS server, contains a security flaw in how it handles authenticated requests over modern protocols like gRPC, QUIC, and DNS-over-HTTPS. An attacker can bypass security checks to perform unauthorized actions, such as downloading entire database zones or modifying DNS records. This could lead to sensitive data exposure or the redirection of network traffic to malicious sites.

Technologies: CoreDNS, github.com/coredns/coredns (Go). Vendors: CoreDNS, Go.

Quick answers

Is CVE-2026-35579 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35579 being exploited in the wild.
How severe is CVE-2026-35579?
Critical severity, with a CVSS score of 9.8, published 5 May 2026.
Which products and versions are affected?
CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.
Is there a fix for CVE-2026-35579?
Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35579 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-35579?
Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coredns/coredns (Go): upgrade to 1.14.3 or later
    go get github.com/coredns/coredns@v1.14.3

Technical details

A vulnerability in CoreDNS's transport implementations (gRPC, QUIC, DoH, and DoH3) leads to a TSIG authentication bypass. In gRPC and QUIC, the server validates that a TSIG key name exists but fails to call dns.TsigVerify() to check the HMAC, accepting any MAC if the key name is valid. In DoH and DoH3, the implementation unconditionally returns a successful authentication status without inspecting the TSIG record at all. This allows remote, unauthenticated attackers to perform TSIG-gated operations such as AXFR/IXFR zone transfers and dynamic DNS updates. The issue is fixed in version 1.14.3.

Affected products

  • CoreDNS CoreDNS < 1.14.3
  • Red Hat Advanced Cluster Management for Kubernetes 2.14

Identifiers

  • CVE-2026-35579
  • GHSA-vp29-5652-4fw9
  • GO-2026-5667

Timeline

  • 2026-04-25: advisory: GitHub Security Advisory published by CoreDNS
  • 2026-05-05: disclosed: NVD publication date
  • 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25127

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.