TI-2026-58862 Aliases CVE-2026-86003 GHSA-9gm5-9rfh-m6vx

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

LOW 39CWE-441Published 2026-09-16 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names, alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00436 38th percentileScored 2026-11-07

Fix Partial coredns (coredns): 1.14.7github.com/coredns/coredns (Go): 1.14.7Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
coredns	coredns	before 1.14.7	1.14.7	Patch available	CNA
—	github.com/coredns/coredns (Go)	before 1.14.7	1.14.7	Patch available	GHSA-9gm5-9rfh-m6vx

coredns Vendorcoredns Affected before 1.14.7 Fixed in 1.14.7 Patch available CNA
github.com/coredns/coredns (Go) Vendor— Affected before 1.14.7 Fixed in 1.14.7 Patch available GHSA-9gm5-9rfh-m6vx

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:coredns.io:coredns::::::::	—	—	coredns

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:* Versions — — ·coredns

Remediation

Fix · CNA coredns (coredns) Fixed in 1.14.7
Fix · GHSA-9gm5-9rfh-m6vx github.com/coredns/coredns (Go) Fixed in 1.14.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Connectivity Link 1	Affected	No fix yet
Red Hat OpenShift Container Platform 4	Affected	No fix yet

Not affected: 3 products

Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Container Platform 5

Timeline

2026-10-02 Threatist record created from CVE-2026-86003
2026-10-03 Alias added: GHSA-9gm5-9rfh-m6vx
2026-10-29 Affected versions changed · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-86003

Other 4

TI-2026-25615 CoreDNS TSIG authentication bypass on encrypted DNS transports CVSS 4.0HIGH 8.7
TI-2026-25384 CoreDNS DoH GET path missing size validation causes CPU and memory amplification CVSS 4.0HIGH 8.7
TI-2026-25382 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service CVSS 4.0HIGH 8.7
TI-2026-27682 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports CVSS 4.0HIGH 8.2
TI-2026-25885 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison CVSS 4.0HIGH 8.2
TI-2026-56816 CoreDNS: Unauthenticated memory exhaustion in custom transports CVSS 3.1HIGH 7.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences