CVE-2026-33190

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.3

Description The tsig plugin can be bypassed on non-plain-DNS transports, specifically DoT, DoH, DoH3, DoQ, and gRPC. This occurs because the plugin relies on the transport writer's TsigStatus() function instead of performing its own verification. Specifically, the TsigStatus() function for DoH, DoH3, DoQ, and gRPC writers unconditionally returns nil, and the DoT server fails to set TsigSecret on the dns.Server. This flaw allows an unauthenticated remote client to bypass TSIG-based authentication and access resources restricted by a tsig require all policy, such as privileged queries or zone data. Plain DNS over TCP and UDP are not affected.

Recommendations Update CoreDNS to version 1.14.3 or later.