Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-86003CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
High 7.5
In plain English
A high-severity security flaw in coredns from coredns. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names, alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/coredns/coredns | 1.14.7 | GHSA-9gm5-9rfh-m6vx |
| Go | github.com/coredns/coredns | 1.14.7 | GO-2026-6506 |
Affected products (as reported)
Weakness: CWE-441 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/coredns/coredns/security/advisories/GHSA-9gm5-9rfh-m6vx x_refsource_CONFIRM
- https://github.com/coredns/coredns/commit/530b0a5ff2ad68cc0421f10dd93568945cc671c9 x_refsource_MISC
- https://github.com/coredns/coredns/releases/tag/v1.14.7 x_refsource_MISC