8.7

CVE-2026-33190: CoreDNS TSIG authentication bypass on encrypted DNS transports

Analyzed
AliasesCGA-25x5-qgp7-wwhxCGA-3pf2-9qgj-r85hCGA-3rf2-7w7h-gghr
Published 05-05-2026Last modified 06-05-2026

Vulnerability summary

CVE-2026-33190 is a high (CVSS 8.7) vulnerability in coredns. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.37%
0%100%
Low · -0.15 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:10673-1OPENSUSE-SU-2026:21483-1CGA-VHV4-MM4H-98R2

Timeline

  1. 05-05-2026
    PublishedVulnerability first disclosed.
  2. 06-05-2026
    Last modifiedVulnerability information updated.

Description

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.

CVSS metrics

7 scores · 5 sources · 2 versions

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

Decrease -0.15 pp

From 0.53% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Coredns

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard22 products
  • coredns-1.13All versions (No fix recorded)
  • coredns-fips-1.13All versions (No fix recorded)
  • eks-distro-coredns-1.30All versions (No fix recorded)
  • eks-distro-coredns-1.31< 1.31.43-r2
  • eks-distro-coredns-1.32< 1.32.36-r2
Wolfi5 products
  • coredns-1.13All versions (No fix recorded)
  • juicefs-1.3< 1.3.1-r14
  • k8s_gateway< 1.8.0-r1
  • kubernetes-dns-node-cache< 1.26.8-r3
  • kuma-coredns-1.13All versions (No fix recorded)
Coredns1 product
Coredns.io1 product
Github.com/coredns1 product
  • coredns< 1.14.3

5 vendors · 30 products

References

5 links