# CVE-2026-35579: CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports

Source: https://junglewise.ai/threats/cve-2026-35579-coredns-tsig-authentication-bypass-in-grpc-quic-and-doh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-35579 · Severity: critical · CVSS 9.8 · Published 2026-05-05

CoreDNS, a widely used DNS server, contains a security flaw in how it handles authenticated requests over modern protocols like gRPC, QUIC, and DNS-over-HTTPS. An attacker can bypass security checks to perform unauthorized actions, such as downloading entire database zones or modifying DNS records. This could lead to sensitive data exposure or the redirection of network traffic to malicious sites.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-35579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35579 being exploited in the wild.

**How severe is CVE-2026-35579?** Critical severity, with a CVSS score of 9.8, published 5 May 2026.

**Which products and versions are affected?** CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

**Is there a fix for CVE-2026-35579?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35579 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-35579?** Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.3 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.3
  ```


## Technical details

A vulnerability in CoreDNS's transport implementations (gRPC, QUIC, DoH, and DoH3) leads to a TSIG authentication bypass. In gRPC and QUIC, the server validates that a TSIG key name exists but fails to call dns.TsigVerify() to check the HMAC, accepting any MAC if the key name is valid. In DoH and DoH3, the implementation unconditionally returns a successful authentication status without inspecting the TSIG record at all. This allows remote, unauthenticated attackers to perform TSIG-gated operations such as AXFR/IXFR zone transfers and dynamic DNS updates. The issue is fixed in version 1.14.3.

## Affected products

- CoreDNS CoreDNS < 1.14.3
- Red Hat Advanced Cluster Management for Kubernetes 2.14

## Identifiers

- CVE-2026-35579
- GHSA-vp29-5652-4fw9
- GO-2026-5667

## Timeline

- 2026-04-25: advisory: GitHub Security Advisory published by CoreDNS
- 2026-05-05: disclosed: NVD publication date
- 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25127

## References

- [https://github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9](https://github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9)
- [https://access.redhat.com/errata/RHSA-2026:25127](https://access.redhat.com/errata/RHSA-2026:25127)
- [https://access.redhat.com/security/cve/CVE-2026-35579](https://access.redhat.com/security/cve/CVE-2026-35579)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2466905](https://bugzilla.redhat.com/show_bug.cgi?id=2466905)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35579.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35579.json)

## Related threats

- [CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc)
- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)