CoreDNS ACL Bypass
cve-program · CVE-2026-26017
PublishedCoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.
Read the publisher's advisoryeuvd · EUVD-2026-10042
PublishedCoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.
Read the publisher's advisorynvd · CVE-2026-26017
PublishedCoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.
Read the publisher's advisoryosv · GHSA-c9v3-4pv7-87pr
PublishedA logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. ### Impact In multi-tenant Kubernetes clusters, this flaw undermines DNS-based segmentation strategies. Example scenario: 1. ACL blocks access to *.admin.svc.cluster.local 2. A rewrite rule maps public-name → admin.svc.cluster.local 3. An unprivileged pod queries public-name 4. ACL allows the request 5. Rewrite exposes the internal admin service IP This allows unauthorized service discovery and reconnaissance of restricted internal infrastructure. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds - Reorder the default plugin.cfg so that: - rewrite and other normalization plugins run before acl, opa, and firewall - Ensure all access control checks are applied after name normalization.
Read the publisher's advisoryosv · GO-2026-4630
PublishedCoreDNS ACL Bypass in github.com/coredns/coredns
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-26017 · CVE overview and exploitation status
cve-program · CVE-2026-26017
- https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr
- https://github.com/coredns/coredns/releases/tag/v1.14.2
euvd · EUVD-2026-10042
- https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr
- https://github.com/coredns/coredns/releases/tag/v1.14.2
nvd · CVE-2026-26017
- https://github.com/coredns/coredns/releases/tag/v1.14.2
- https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr
- https://access.redhat.com/errata/RHSA-2026:25127
- https://access.redhat.com/errata/RHSA-2026:36873
- https://access.redhat.com/errata/RHSA-2026:8151
- https://access.redhat.com/security/cve/CVE-2026-26017
- https://bugzilla.redhat.com/show_bug.cgi?id=2445244
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json
osv · GHSA-c9v3-4pv7-87pr
- https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr
- https://nvd.nist.gov/vuln/detail/CVE-2026-26017
- https://github.com/coredns/coredns
- https://github.com/coredns/coredns/releases/tag/v1.14.2
osv · GO-2026-4630
Related changes
Linked by CVE identifierNo related changes are available here.