CVE-2026-26017

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json

https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr

https://github.com/coredns/coredns/releases/tag/v1.14.2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10042

https://bugzilla.redhat.com/show_bug.cgi?id=2445244

https://access.redhat.com/security/cve/CVE-2026-26017

https://access.redhat.com/errata/RHSA-2026:8151

https://access.redhat.com/errata/RHSA-2026:36873

https://access.redhat.com/errata/RHSA-2026:25127

Details

Source: Mitre, NVD

Named Vulnerability: GO-2026-4630Named Vulnerability: GHSA-c9v3-4pv7-87pr

Risk Information

CVSS v2

CVSS v3

EPSS