Junglewise Threat Intelligence

CVE-2026-35579: CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports

CVE-2026-35579 · Severity: critical · CVSS 9.8 · Published 2026-05-05

Executive brief

CoreDNS, a widely used DNS server, contains a security flaw in how it handles authenticated requests over modern protocols like gRPC, QUIC, and DNS-over-HTTPS. An attacker can bypass security checks to perform unauthorized actions, such as downloading entire database zones or modifying DNS records. This could lead to sensitive data exposure or the redirection of network traffic to malicious sites.

Technical details

A vulnerability in CoreDNS's transport implementations (gRPC, QUIC, DoH, and DoH3) leads to a TSIG authentication bypass. In gRPC and QUIC, the server validates that a TSIG key name exists but fails to call dns.TsigVerify() to check the HMAC, accepting any MAC if the key name is valid. In DoH and DoH3, the implementation unconditionally returns a successful authentication status without inspecting the TSIG record at all. This allows remote, unauthenticated attackers to perform TSIG-gated operations such as AXFR/IXFR zone transfers and dynamic DNS updates. The issue is fixed in version 1.14.3.

Affected products

  • CoreDNS CoreDNS < 1.14.3
  • Red Hat Advanced Cluster Management for Kubernetes 2.14

Timeline

  • 2026-04-25: advisory: GitHub Security Advisory published by CoreDNS
  • 2026-05-05: disclosed: NVD publication date
  • 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25127

References

Related threats