Detections
Analytics

Echo: github.com/coredns/coredns: security update to 1.14.7

high Tenable Self-Hosted Container Security Plugin ID 462933

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-
 QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and
 core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used
 by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or
 forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source
 address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to
 originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names,
 alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7. (CVE-2026-86003)

Solution

Update the github.com/coredns/coredns library and its related packages to version 1.14.7 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-86003

Plugin Details

Severity: High

ID: 462933

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-86003

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-86003