Vulnerability CVE-2026-26017: Information

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

Severity: MEDIUM (6.3)

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-26017

Published: March 6, 2026

Modified: March 9, 2026

Error type identifier: CWE-367

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://github.com/coredns/coredns/releases/tag/v1.14.2	Product Release Notes
https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr	Mitigation Vendor Advisory
GHSA-c9v3-4pv7-87pr	GHSA

Affected configurations:
1. cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*
  End excluding
  1.14.2

Version: v26.6.1