CVE-2026-33190 Details
Description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.
A vulnerability in CoreDNS versions prior to 1.14.3 allows for TSIG authentication bypass on non-plain-DNS transports, including DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over HTTPS version 3 (DoH3), DNS over QUIC (DoQ), and gRPC. The issue arises because the TSIG plugin relies on the transport writer's TsigStatus() for validation, rather than performing its own verification. This flaw enables an unauthenticated remote client to bypass TSIG-based authentication and access resources meant to be restricted under a 'tsig require all' policy. The vulnerability does not affect plain DNS over TCP or UDP.
Users can upgrade to CoreDNS version 1.14.3, which includes the necessary TSIG verification for DoH, DoH3, QUIC, and gRPC transports.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh | CISA-ADP | ExploitVendor Advisory |
| https://github.com/coredns/coredns/releases/tag/v1.14.3 | [email protected] | Release Notes |
| https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-303 | Incorrect Implementation of Authentication Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coredns.io coredns | < 1.14.3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |