PT-2026-35932
CVE-2026-35579
·
Published
2026-04-28
·
Updated
2026-09-18
Description by
CVSS 2.0
10
CriticalMetricsAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
CoreDNS versions prior to 1.14.3
Description
Incorrect handling of TSIG (Transaction Signature) authentication in gRPC, QUIC, DoH (DNS over HTTPS), and DoH3 transport implementations allows an unauthenticated network attacker to bypass security protections. This can lead to unauthorized access to restricted functionalities, including AXFR/IXFR zone transfers and dynamic DNS updates.
Technical details include:
- For gRPC and QUIC, the server verifies the TSIG key name but fails to call the
dns.TsigVerify()function to validate the HMAC. If the key name is valid, thetsigStatusvariable remains nil, leading the system to treat the request as authenticated regardless of the MAC value. - For DoH and DoH3, the
DoHWriter.TsigStatus()function unconditionally returns nil, and the server does not inspect the TSIG record. Consequently, any request containing a TSIG record is treated as authenticated, even with an invalid key name or arbitrary MAC.
Recommendations
Update CoreDNS to version 1.14.3.
As a temporary workaround, disable gRPC, QUIC, DoH, and DoH3 listeners where TSIG authentication is required.
Restrict network-level access to the affected transport ports to trusted sources only.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾