# CVE-2026-86003: CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC

Source: https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-86003 · Severity: high · CVSS 7.5 · Published 2026-09-16

CoreDNS, a DNS server commonly used in cloud and containerized environments, failed to block unauthorized DNS record modification requests (RFC 2136 UPDATE messages) when received over encrypted protocols like HTTPS (DoH), QUIC (DoQ), and gRPC. An attacker could exploit this to modify DNS records through CoreDNS if the upstream server trusts CoreDNS's connection without requiring cryptographic authentication, potentially redirecting traffic or compromising domain ownership.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-86003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86003 being exploited in the wild.

**How severe is CVE-2026-86003?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** CoreDNS before 530b0a5ff2ad68cc0421f10dd93568945cc671c9 (main branch); github.com/coredns/coredns (Go) <= 1.14.6, SEMVER:introduced=0,fixed=1.14.7.

**Is there a fix for CVE-2026-86003?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86003 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86003?** Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.7 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.7
  ```


## Technical details

CoreDNS's DoH, DoH3, DoQ, and DNS-over-gRPC listeners accepted RFC 2136 UPDATE messages (opcode 5) without enforcing the request policy applied by UDP/TCP listeners, which reject non-QUERY/NOTIFY opcodes. The vulnerable code parsed incoming messages via dns.Msg.Unpack without the restrictive DefaultMsgAcceptFunc. Requests were routed based on the Zone question and forwarded unchanged to the upstream, appearing to originate from CoreDNS. An unauthenticated attacker with network access to these listeners could send UPDATE messages that an update-capable upstream would accept if it trusts CoreDNS's source address or authenticated connection instead of requiring end-to-end TSIG validation. The fix applies dnsutil.UnpackRequest, which enforces the same opcode restrictions on all affected transports.

## Affected products

- CoreDNS CoreDNS before 530b0a5ff2ad68cc0421f10dd93568945cc671c9 (main branch)

## Identifiers

- CVE-2026-86003
- GHSA-9gm5-9rfh-m6vx
- GO-2026-6506

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: advisory

## Related threats

- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)
- [CoreDNS TSIG authentication bypass in gRPC, QUIC, and DoH transports](https://junglewise.ai/threats/cve-2026-35579-coredns-tsig-authentication-bypass-in-grpc-quic-and-doh)