Read the docs
TI-2026-25615 Aliases CVE-2026-33190GHSA-qhmp-q7xh-99rh

CoreDNS TSIG authentication bypass on encrypted DNS transports

Priority HIGH 77CWE-303Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial coredns (coredns): 1.14.3github.com/coredns/coredns (Go): 1.14.3Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
corednscorednsbefore 1.14.31.14.3Patch availableCNA
—github.com/coredns/coredns (Go)before 1.14.31.14.3Patch availableGHSA-qhmp-q7xh-99rh
  • coredns Vendorcoredns Affected before 1.14.3 Fixed in 1.14.3 Patch available CNA
  • github.com/coredns/coredns (Go) Vendor— Affected before 1.14.3 Fixed in 1.14.3 Patch available GHSA-qhmp-q7xh-99rh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*before 1.14.3Vulnerablecoredns
  • cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:* Versions before 1.14.3 Vulnerable ·coredns

Remediation

  • Fix · CNA coredns (coredns) Fixed in 1.14.3
  • Fix · GHSA-qhmp-q7xh-99rh github.com/coredns/coredns (Go) Fixed in 1.14.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33190
  2. 2026-10-03 Alias added: GHSA-qhmp-q7xh-99rh

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-25384 CoreDNS DoH GET path missing size validation causes CPU and memory amplification CVSS 4.0HIGH 8.7
  • TI-2026-25382 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service CVSS 4.0HIGH 8.7
  • TI-2026-27682 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports CVSS 4.0HIGH 8.2
  • TI-2026-25885 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison CVSS 4.0HIGH 8.2
  • TI-2026-44486 NULL pointer dereference in coredns CVSS 3.1MEDIUM 5.3
  • TI-2026-44995 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin CVSS 3.1LOW 3.7
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences