CVE-2026-26017

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

PUBLISHED Reserved 2026-02-09 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Product status

References

github.com/...oredns/security/advisories/GHSA-c9v3-4pv7-87pr

github.com/coredns/coredns/releases/tag/v1.14.2

cve.org (CVE-2026-26017)

nvd.nist.gov (CVE-2026-26017)

Download JSON