CVE-2026-26017: CoreDNS ACL Bypass

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-06 · updated 2026-07-15
Weakness: CWE-367

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

Affected products

coredns: before 1.14.2 — fixed in 1.14.2

How to fix

Upgrade to a fixed version: coredns 1.14.2. Check the vendor advisory for mitigations.

References

https://github.com/coredns/coredns/releases/tag/v1.14.2
https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr
https://access.redhat.com/errata/RHSA-2026:25127
https://access.redhat.com/errata/RHSA-2026:36873
https://access.redhat.com/errata/RHSA-2026:8151
https://access.redhat.com/security/cve/CVE-2026-26017
https://bugzilla.redhat.com/show_bug.cgi?id=2445244
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json

Get alerted when CVE-2026-26017 or the next vulnerability affects your stack