Logical Vulnerability in CoreDNS Server Affecting Plugin Execution Order
CVE-2026-26017

7.7HIGH

Key Information:

Vendor

Coredns

Status
Coredns
Vendor
CVE Published:
6 March 2026

What is CVE-2026-26017?

A logical vulnerability in CoreDNS prior to version 1.14.2 enables attackers to bypass DNS access controls. This arises from the default execution order of plugins, where security plugins like 'acl' are checked before 'rewrite'. This results in a Time-of-Check Time-of-Use (TOCTOU) flaw, which can be exploited to manipulate DNS responses. Users are advised to upgrade to version 1.14.2 or later to mitigate this issue.

Affected Version(s)

coredns < 1.14.2

References

https://github.com/coredns/coredns/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/coredns/coredns/releases/tag/v1.14.2
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.