Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CoreDNS allows unauthenticated access via encrypted DNS
published 6 months ago
Summary
The CoreDNS DNS server (versions before 1.14.3) can be tricked into accepting requests over encrypted connections without proper authentication. This lets remote users bypass security checks that were meant to protect certain resources. Upgrade CoreDNS to version 1.14.3 or later to close the gap.
What to do
- Update azure coredns to version 1.11.4-17.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | coredns |
< 1.11.4-17 Fix: upgrade to 1.11.4-17
|
Original advisory text
CVE-2026-33190 affecting package coredns for versions less than 1.11.4-17
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.
References
Timeline
Published5 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-85718 · OSV
Track software like this
Free during beta