CoreDNS TSIG authentication bypass on encrypted DNS transports

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33190 · CVE overview and exploitation status

EUVD-2026-27444

GHSA-qhmp-q7xh-99rh

GO-2026-5583

cve-program · CVE-2026-33190

• https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh
• https://github.com/coredns/coredns/releases/tag/v1.14.3

euvd · EUVD-2026-27444

• https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh
• https://github.com/coredns/coredns/releases/tag/v1.14.3

nvd · CVE-2026-33190

• https://github.com/coredns/coredns/releases/tag/v1.14.3
• https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh

osv · GHSA-qhmp-q7xh-99rh

• https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh
• https://nvd.nist.gov/vuln/detail/CVE-2026-33190
• https://github.com/coredns/coredns
• https://github.com/coredns/coredns/releases/tag/v1.14.3

osv · GO-2026-5583

• https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh
• https://nvd.nist.gov/vuln/detail/CVE-2026-33190
• https://github.com/coredns/coredns/releases/tag/v1.14.3

• CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performin… · Advisory content revised · 15 Nov 2026